SAP Security Patch Day – April 2022
Chapters
Share Article
On 12th of April 2022, SAP Security Patch Day revealed 22 new Security Notes for the SAP product portfolio. Furthermore, SAP included 9 updates to previously released Patch Day Security Notes.
SAP Security Patches April 2022
Before we focus on the content of the SAP Security Patch Day, we want to highlight SAP announced a changed release schedule. The SAP Response Team will keep publishing the Security Notes every second Tuesday of a month but from July 2022 onwards those will be made available on 9:00 am CE(S)T, instead of 03:00 am.
Highlights
Many of our readers may have read it on the news, another open-source component has been identified that is widely used and contains a severe vulnerability. The vulnerability goes by the name Spring4Shell, in association with its predecessor Log4j. Spring4Shell describes a vulnerability that exists within the Spring Framework. The Spring Framework is a JAVA Framework that provides many standardizations for database interaction and web-based developments. Since the component is widely used SAP has released a central note 3170990 that collects all findings of the vulnerability within the enterprise-critical SAP applications. To date, only the SAP HANA Extended Application Services is listed, and a correction is provided via SNote 3189428. SecurityBridge customers can access a dedicated page within our knowledge base dealing with Spring4Shell and how it is covered within the SecurityBridge platform.
Next to multiple updates, some new vulnerabilities have been found and fixed within the SAP Web Dispatcher and the Internet Communication Manager that exists in SAP NetWeaver ABAP/JAVA.
SNote 311311 comes with Priority “High” and contains the correction for a potential “Denial of Service” attack against the sometimes internet-facing components. Please also look at updates of SNote 3123427 that contains the fix for the HTTP Request Smuggling vulnerability in SAP Web Dispatcher and the Internet Communication Manager.
With a medium priority, the correction of Apache Log2j 2 component in SAP NetWeaver ABAP Server and ABAP Platform in the Adobe LiveCycle Designer 11.0 has been released with 3138299.
Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.
Summary by Severity
The April release contains a total of 21 patches for the following severities:
| Severity | Number |
|---|---|
|
Hot News
|
5 |
|
High
|
3 |
|
Medium
|
12 |
|
Low
|
1 |
| Note | Description | Severity | CVSS |
|---|---|---|---|
| 3055044 | [CVE-2022-28213] Missing XML Validation vulnerability in SAP BusinessObjects Business Intelligence Platform
(dswsbobje - SOAP Web services) Priority: Correction with medium priority Released on: 12.04.2022 Components: BI-DEV-WEB Category: Program error |
Medium | 5,4 |
| 3163583 | [CVE-2022-26105] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Priority: Correction with medium priority Released on: 12.04.2022 Components: EP-PIN-PRT Category: Program error |
Medium | 6,1 |
| 3159091 | [CVE-2022-27657] Directory Traversal vulnerability in SAP Focused Run (Simple Diagnostics Agent
1.0) Priority: Correction with low priority Released on: 12.04.2022 Components: SV-FRN-INF-SDA Category: Program error |
Low | 2,7 |
| 3158613 | Update 1 to Security Note 3022622 - [CVE-2021-21480] Code injection vulnerability in SAP Manufacturing
Integration and Intelligence Priority: HotNews Released on: 12.04.2022 Components: MFG-MII Category: Program error |
Hot News | 9,1 |
| 3155609 | Privilege escalation vulnerability in Apache Tomcat server component of SAP Commerce Priority: Correction with high priority Released on: 12.04.2022 Components: CEC-COM-CPS Category: Program error |
High | 7,0 |
| 3130497 | [CVE-2022-27671] CSRF token visible in one of the URL in SAP Business Intelligence Platform. Priority: Correction with high priority Released on: 12.04.2022 Components: BI-BIP-CMC Category: Program error |
High | 8,2 |
| 3111293 | [CVE-2022-28773] Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication
Manager) Priority: Correction with medium priority Released on: 12.04.2022 Components: BC-CST-WDP Category: Program error |
Medium | 4,9 |
| 3111311 | [CVE-2022-28772]Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication
Manager) Priority: Correction with high priority Released on: 12.04.2022 Components: BC-CST-WDP Category: Program error |
High | 7,5 |
| 3152442 | [CVE-2022-27669] Missing Authentication check in XML Data Archiving Service Priority: Correction with medium priority Released on: 12.04.2022 Components: BC-ILM-DAS Category: Program error |
Medium | 5,3 |
| 3150845 | [CVE-2022-28216] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence
Platform (BI Workspace) Priority: Correction with medium priority Released on: 12.04.2022 Components: BI-BIP-BIW Category: Program error |
Medium | 4,3 |
| 3148377 | [CVE-2022-28217] Missing XML Validation vulnerability in SAP NW EP WPC Priority: Correction with medium priority Released on: 12.04.2022 Components: EP-PIN-WPC Category: Correction of legal function |
Medium | 6,5 |
| 3148094 | [CVE-2022-27670] Denial of service (DOS) in SQL Anywhere Priority: Correction with medium priority Released on: 12.04.2022 Components: BC-SYB-SQA Category: Program error |
Medium | 6,5 |
| 3145769 | [CVE-2022-27667] Information Disclosure vulnerability in CMC Priority: Correction with medium priority Released on: 12.04.2022 Components: BI-BIP-ADM Category: Program error |
Medium | 5,3 |
| 3143437 | [Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer Priority: Correction with medium priority Released on: 12.04.2022 Components: CA-VE-VEV Category: Program error |
Medium | 6,5 |
| 3138299 | [CVE-2021-44832] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP
NetWeaver ABAP Server and ABAP Platform (Adobe LiveCycle Designer 11.0) Priority: Correction with medium priority Released on: 12.04.2022 Components: XX-PART-ADB-IFM Category: Program error |
Medium | 4,1 |
| 3137191 | [CVE-2022-22541] Information Disclosure vulnerability in SAP BusinessObjects Platform Priority: Correction with medium priority Released on: 12.04.2022 Components: BI-BIP-ADM Category: Program error |
Medium | 6,8 |
| 3128473 | [CVE-2022-22545] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP
Platform Priority: Correction with medium priority Released on: 08.02.2022 Components: BC-MID-RFC Category: Program error |
Medium | 4,9 |
| 3022622 | [CVE-2021-21480] Code injection vulnerability in SAP Manufacturing Integration and Intelligence Priority: HotNews Released on: 09.03.2021 Components: MFG-MII Category: Program error |
Hot News | 9,1 |
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Priority: HotNews Released on: 10.04.2018 Components: BC-FES-BUS-DSK Category: Program error |
Hot News | 10,0 |
| 3189428 | [CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP HANA
Extended Application Services Priority: HotNews Released on: 12.04.2022 Components: BC-XS-SEC Category: Program error |
Hot News | 9,8 |
| 3170990 | [CVE-2022-22965] Central Security Note for Remote Code Execution vulnerability associated with Spring
Framework Priority: HotNews Released on: 12.04.2022 Components: XX-SER-SN Category: Program error |
Hot News | 9,8 |