Like last month, the number of released notes is somewhat higher: 21 new notes in total and 4 updates to existing notes. 

See below for the highlights and the end of this post for a complete overview. 

High priority 

There are no security notes with the highest priority ‘HotNews’. So, we start with the ones that have priority ‘High’.

SAP Commerce is again affected by some found vulnerabilities as we have seen last months a few times already. This is often caused by vulnerabilities in underlying libraries and this time is no different. Note 3569602 describes how a vulnerable version of swagger-ui is packaged and needs updating of the SAP Commerce Cloud component. Note 3566851 addresses a similar issue but here it is the packaged Apache Tomcat version that is vulnerable. These examples clearly demonstrate how vulnerabilities in base packages trickle down to other software components that rely on these.

The 3 other notes with priority ‘High’ are quite straight forward. Note 3563927 describes a missing authorization check that needs fixing. Note 3567974 and 3483344 have minor updates in the correction instructions or description.

Medium and low priority

We see a large number of vulnerabilities in this category, mainly Cross-Site Scripting (XSS) vulnerabilities and missing authorization checks, among others. The majority simply needs patching of the component involved, we will not go further into these. Some interesting points below:

Note 3558132 describes an information disclosure vulnerability for SAP Web Dispatcher and ICM components. Keep in mind that this requires either a standalone or embedded Web Dispatcher and that the patching process is different.

Note 3562415 is another example of packaged libraries that contain vulnerabilities although with a lower priority (Low). Note that this concerns both SAP Commerce Cloud and SAP Datahub.

Note 3576540 is not a security note to fix a certain vulnerability but describes best practices to follow for Java applications that are implemented with the Spring Framework and run on BTP Cloud Foundry, KYMA or NEO environments. More specifically, it describes how to prevent sensitive endpoints to be accessible that are normally used for debugging purposes. These are very valuable considerations for any landscape to verify where Java applications are deployed. We look forward to more notes like these where concrete security measures are described!

SecurityBridge findings

At SecurityBridge we do not only deliver a complete SAP Security solution for our customers. We also conduct research on several SAP Security topics. From this, we regularly discover vulnerabilities ourselves which we address in close cooperation with SAP. This month, we are proud to note that 2 vulnerabilities come directly from these research efforts: note 3557131 and 3568865. Credits to Joris van de Vis, our own Director Security Research!