We are rapidly approaching summer vacation. Despite the holiday season the SAP Security Response team remains very active also with this months patchday. Today, the 14th of July 2020, 7 new patches and 2 updates to existing patches have been released.

SAP released a correction for a remote code exploitation vulnerability with Note 2934135. The HotNews correction (with CVSS 10 !!) for the NetWeaver AS JAVA impacts versions starting from 7.30 all the way to 7.50. We have published the following Security Advisory for 2934135.

Caused by a missing authentication check in SAP standard, attackers may execute administrative tasks without prior authentication. Our team recommends to apply the patch as soon as possible!

If you can’t apply the patch, Note 2939665 provides a workaround to disable the critical API’s in LM Configuration Wizard.

With note 2932473 (CVSS 7.7) a correction for XMLToolkit, again for JAVA in SAP NetWeaver ENGINEAPI was published. The correction resolves an information disclosure vulnerability, which may allow an internal attacker to gain access to various server files.

Another SAP HotNews correction, from the July Patchday, received an update. Note 2622660, first released in April’18, has been subject of multiple updates by the SAP SE security expert teams.

The SecurityBridge Platform addresses all the relevant aspects of cyber security for SAP. While exploitation of many vulnerabilities can not be prevented before the correction was installed, malicious actions can be detected by SecurityBridge Threat Detection. SecurityBridge helps enterprises to analyse, prevent and correct security issues.