SAP© Security Advisories - 10 2020 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 21 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 21

System Types

Affected SAP© system types

_{Related note}
2955963

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Cross-Site Request Forgery (CSRF) in SAP Marketing

Security Advisory

_{Related note}
2973100

_CVSS
3.6

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Missing Authorization check in Manage Substitutions - Products and Manage Exclusions - Products

Security Advisory

_{Related note}
2965287

_CVSS
3.7

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6363] Insufficient Session Expiration in SAP Commerce Cloud

Security Advisory

_{Related note}
2956398

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6319] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java

Security Advisory

_{Related note}
2873099

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Missing Authorization check in EHS Task Definition attachments

Security Advisory

_{Related note}
2945581

_CVSS
4.7

_{Affected system
type}
SAP CRM UI

_Patchday
2020-10

_{Released
on}
2020/09/22

Description
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
2960329

_CVSS
4.4

_{Affected system
type}
SAP Enterprise Portal...

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6323] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (Fiori Framework Page)

Security Advisory

_{Related note}
2953212

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6362] Incorrect Authorization in SAP Banking Services

Security Advisory

_{Related note}
2969828

_CVSS
10.0

_{Affected system
type}
Solution Manager

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6364] OS Command Injection Vulnerability in CA Introscope Enterprise Manager (Affected Products: SAP Solution Manager and SAP Focused Run)

Security Advisory

_{Related note}
2943844

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6308] Server-Side Request Forgery vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Services)

Security Advisory

_{Related note}
2606194

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/09/09

Description
Cross-Site Scripting (XSS) vulnerability in CRM Interaction Center

Security Advisory

_{Related note}
2965315

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6365] Reverse Tabnabbing vulnerability in SAP NetWeaver AS Java Start Page

Security Advisory

_{Related note}
2917381

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6272] Cross-Site Scripting (XSS) vulnerability in SAP Commerce Cloud

Security Advisory

_{Related note}
2972661

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6367] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Composite Application Framework

Security Advisory

_{Related note}
2883638

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Information Disclosure in Supplier Relationship Management

Security Advisory

_{Related note}
2960825

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6368] Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation

Security Advisory

_{Related note}
2963137

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6371] Information disclosure in SAP NetWeaver AS ABAP via the POWL Test Feeder endpoint

Security Advisory

_{Related note}
2969457

_CVSS
7.6

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6366] Missing XML Validation in SAP NetWeaver (Compare Systems)

Security Advisory

_{Related note}
2973497

_CVSS
5.7

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6315] Multiple Vulnerabilities in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
2939419

_CVSS
4.8

_{Affected system
type}
SAP NetWeaver...

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6370] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (DI Design Time Repository)

Security Advisory

_{Related note}
2971638

_CVSS
7.5

_{Affected system
type}
SAP Solution Manager...

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6369] Hard-coded Credentials in CA Introscope Enterprise Manager (Affected products: SAP Solution Manager and SAP Focused Run)

Security Advisory

Notifications

Severity

SAP© Security advisories 21

System Types

Affected SAP© system types

Related note 2955963

CVSS 4.3

Affected system type ABAP

Patchday2020-10

Released on2020/10/13

Related note 2973100

CVSS 3.6

Affected system type ABAP

Patchday2020-10

Released on2020/10/13

Related note 2965287

CVSS 3.7

Affected system type SAP Commerce Cloud

Patchday2020-10

Released on2020/10/13

Related note 2956398

CVSS 6.1

Affected system type Java

Patchday2020-10

Released on2020/10/13

Related note 2873099

CVSS 5.4

Affected system type ABAP

Patchday2020-10

Released on2020/10/13

Related note 2945581

CVSS 4.7

Affected system type SAP CRM UI

Patchday2020-10

Released on2020/09/22

Related note 2960329

CVSS 4.4

Affected system type SAP Enterprise Portal...

Patchday2020-10

Released on2020/10/13

Related note 2953212

CVSS 4.3

Affected system type ABAP

Patchday2020-10

Released on2020/10/13

Related note 2969828

CVSS 10.0

Affected system type Solution Manager

Patchday2020-10

Released on2020/10/13

Related note 2943844

CVSS 5.3

Affected system type BI/BO platform

Patchday2020-10

Released on2020/10/13

Related note 2606194

CVSS 4.4

Affected system type ABAP

Patchday2020-10

Released on2020/09/09

Related note 2965315

CVSS 4.7

Affected system type Java

Patchday2020-10

Released on2020/10/13

Related note 2917381

CVSS 5.4

Affected system type SAP Commerce Cloud

Patchday2020-10

Released on2020/10/13

Related note 2972661

CVSS 8.2

Affected system type Java

Patchday2020-10

Released on2020/10/13

Related note 2883638

CVSS 6.5

Affected system type ABAP

Patchday2020-10

Released on2020/10/13

_{Related note}
2955963

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2973100

_CVSS
3.6

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2965287

_CVSS
3.7

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2956398

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2873099

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2945581

_CVSS
4.7

_{Affected system
type}
SAP CRM UI

_Patchday
2020-10

_{Released
on}
2020/09/22

_{Related note}
2960329

_CVSS
4.4

_{Affected system
type}
SAP Enterprise Portal...

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2953212

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2969828

_CVSS
10.0

_{Affected system
type}
Solution Manager

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2943844

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2606194

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/09/09

_{Related note}
2965315

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2917381

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2972661

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2883638

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

_{Related note}
2960825

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13