SAP© Security Advisories - 04 2022 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 28 and the highest CVSS score is 9.8.

Severity

SAP© Security advisories 28

System Types

Affected SAP© system types

_{Related note}
3130497

_CVSS
8.2

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27671] CSRF token visible in one of the URL in SAP Business Intelligence Platform.

Security Advisory

_{Related note}
3148377

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28217] Missing XML Validation vulnerability in SAP NW EP WPC

Security Advisory

_{Related note}
3055044

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28213] Missing XML Validation vulnerability in SAP BusinessObjects Business Intelligence Platform (dswsbobje - SOAP Web services)

Security Advisory

_{Related note}
3137191

_CVSS
6.8

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22541] Information Disclosure vulnerability in SAP BusinessObjects Platform

Security Advisory

_{Related note}
3163583

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-26105] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3148094

_CVSS
6.5

_{Affected system
type}
Sybase

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27670] Denial of service (DOS) in SQL Anywhere

Security Advisory

_{Related note}
3189428

_CVSS
9.8

_{Affected system
type}
SAP HANA Platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP HANA Extended Application Services

Security Advisory

_{Related note}
3150845

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28216] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (BI Workspace)

Security Advisory

_{Related note}
3138299

_CVSS
4.1

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2021-44832] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP NetWeaver ABAP Server and ABAP Platform (Adobe LiveCycle Designer 11.0)

Security Advisory

_{Related note}
3111311

_CVSS
7.5

_{Affected system
type}
Kernel

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28772]Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)

Security Advisory

_{Related note}
3145769

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27667] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC)

Security Advisory

_{Related note}
3132633

_CVSS
5.4

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Information Disclosure vulnerability in SAP GUI for Windows

Security Advisory

_{Related note}
3189635

_CVSS
9.8

_{Affected system
type}
SAP Customer...

_Patchday
2022-04

_{Released
on}
2022/04/14

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP Customer Profitability Analytics

Security Advisory

_{Related note}
3163703

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Multiple Vulnerabilities in URI.js bundled with SAPUI5

Security Advisory

_{Related note}
3101986

_CVSS
4.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Prepare CSP support for On-Premise down port for code dependency in SAP CRM WebClient UI

Security Advisory

_{Related note}
3126557

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28770] Cross-Site Scripting (XSS) vulnerability in SAPUI5 (vbm library)

Security Advisory

_{Related note}
3187290

_CVSS
9.8

_{Affected system
type}
SAP Customer Checkout

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP Customer Checkout

Security Advisory

_{Related note}
3143437

_CVSS
6.5

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3158613

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Update 1 to Security Note 3022622 - [CVE-2021-21480] Code injection vulnerability in SAP Manufacturing Integration and Intelligence

Security Advisory

_{Related note}
3165856

_CVSS
4.3

_{Affected system
type}
SAP Innovation Management

_Patchday
2022-04

_{Released
on}
2022/03/28

Description
[CVE-2022-27658] Missing authorization check in SAP Innovation Management

Security Advisory

_{Related note}
3155609

_CVSS
7.0

_{Affected system
type}
SAP Commerce

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Privilege escalation vulnerability in Apache Tomcat server component of SAP Commerce

Security Advisory

_{Related note}
3152442

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27669] Missing Authentication check in XML Data Archiving Service

Security Advisory

_{Related note}
3159091

_CVSS
2.7

_{Affected system
type}
SAP Solution Manager...

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27657] Directory Traversal vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0)

Security Advisory

_{Related note}
3165333

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28215] URL Redirection vulnerability in SAP NetWeaver ABAP Server and ABAP Platform

Security Advisory

_{Related note}
3170990

_CVSS
9.8

_{Affected system
type}
Any

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Central Security Note for Remote Code Execution vulnerability associated with Spring Framework

Security Advisory

_{Related note}
3189429

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in PowerDesigner Web (up to including 16.7 SP05 PL01)

Security Advisory

_{Related note}
3171258

_CVSS
9.8

_{Affected system
type}
SAP Commerce

_Patchday
2022-04

_{Released
on}
2022/04/18

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP Commerce

Security Advisory

_{Related note}
3111293

_CVSS
4.9

_{Affected system
type}
Kernel

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28773] Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)

Security Advisory

Notifications

Severity

SAP© Security advisories 28

System Types

Affected SAP© system types

Related note 3130497

CVSS 8.2

Affected system type BI/BO platform

Patchday2022-04

Released on2022/04/12

Related note 3148377

CVSS 6.5

Affected system type Java

Patchday2022-04

Released on2022/04/12

Related note 3055044

CVSS 5.4

Affected system type BI/BO platform

Patchday2022-04

Released on2022/04/12

Related note 3137191

CVSS 6.8

Affected system type BI/BO platform

Patchday2022-04

Released on2022/04/12

Related note 3163583

CVSS 6.1

Affected system type Java

Patchday2022-04

Released on2022/04/12

Related note 3148094

CVSS 6.5

Affected system type Sybase

Patchday2022-04

Released on2022/04/12

Related note 3189428

CVSS 9.8

Affected system type SAP HANA Platform

Patchday2022-04

Released on2022/04/12

Related note 3150845

CVSS 4.3

Affected system type BI/BO platform

Patchday2022-04

Released on2022/04/12

Related note 3138299

CVSS 4.1

Affected system type Adobe LiveCycle Designer

Patchday2022-04

Released on2022/04/12

Related note 3111311

CVSS 7.5

Affected system type Kernel

Patchday2022-04

Released on2022/04/12

Related note 3145769

CVSS 5.3

Affected system type BI/BO platform

Patchday2022-04

Released on2022/04/12

Related note 3132633

CVSS 5.4

Affected system type SAP GUI / Frontend

Patchday2022-04

Released on2022/04/12

Related note 3189635

CVSS 9.8

Affected system type SAP Customer...

Patchday2022-04

Released on2022/04/14

Related note 3163703

CVSS 6.1

Affected system type ABAP

Patchday2022-04

Released on2022/04/12

Related note 3101986

CVSS 4.1

Affected system type ABAP

Patchday2022-04

Released on2022/04/12

_{Related note}
3130497

_CVSS
8.2

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3148377

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3055044

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3137191

_CVSS
6.8

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3163583

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3148094

_CVSS
6.5

_{Affected system
type}
Sybase

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3189428

_CVSS
9.8

_{Affected system
type}
SAP HANA Platform

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3150845

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3138299

_CVSS
4.1

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3111311

_CVSS
7.5

_{Affected system
type}
Kernel

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3145769

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3132633

_CVSS
5.4

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3189635

_CVSS
9.8

_{Affected system
type}
SAP Customer...

_Patchday
2022-04

_{Released
on}
2022/04/14

_{Related note}
3163703

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3101986

_CVSS
4.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

_{Related note}
3126557

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12