SAP Security Patch Day – July 2020

SAP security Patch day

We are rapidly approaching summer vacation. Despite the holiday season the SAP Security Response team remains very active also with this months patchday. Today, the 14th of July 2020, 7 new patches and 2 updates to existing patches have been released.

SAP released a correction for a remote code exploitation vulnerability with Note 2934135. The HotNews correction (with CVSS 10 !!) for the NetWeaver AS JAVA impacts versions starting from 7.30 all the way to 7.50. We have published the following Security Advisory for 2934135.

Caused by a missing authentication check in SAP standard, attackers may execute administrative tasks without prior authentication. Our team recommends to apply the patch as soon as possible!

If you can’t apply the patch, Note 2939665 provides a workaround to disable the critical API’s in LM Configuration Wizard.

With note 2932473 (CVSS 7.7) a correction for XMLToolkit, again for JAVA in SAP NetWeaver ENGINEAPI was published. The correction resolves an information disclosure vulnerability, which may allow an internal attacker to gain access to various server files.

Another SAP HotNews correction, from the July Patchday, received an update. Note 2622660, first released in April’18, has been subject of multiple updates by the SAP SE security expert teams.

The SecurityBridge Platform addresses all the relevant aspects of cyber security for SAP. While exploitation of many vulnerabilities can not be prevented before the correction was installed, malicious actions can be detected by SecurityBridge Threat Detection. SecurityBridge helps enterprises to analyse, prevent and correct security issues.

Summary by Severity

The July release contains a total of 9 patches for the following severities:

Severity Number
Hot News
2
High
1
Medium
6
Note Description Severity CVSS
2934135 [CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)Additional CVE - CVE-2020-6286
Product - SAP NetWeaver AS JAVA (LM Configuration Wizard); Versions - 7.30, 7.31, 7.40, 7.50 
Hot News
10
2622660 Update to Security Note released on April 2018 Patch Day: Security updates for the browser control Google Chromium delivered with SAP Business Client
Product - SAP Business Client, Version - 6.5
Hot News
9.8
2932473 [CVE-2020-6285] Information Disclosure in SAP NetWeaver (XMLToolkit for Java)
Product - SAP NetWeaver (XML Toolkit for JAVA); Versions - ENGINEAPI 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
High
7.7
2758000 [CVE-2020-6267] Multiple vulnerabilities in SAP Disclosure ManagementAdditional CVEs - CVE-2020-6289, CVE-2020-6290, CVE-2020-6291, CVE-2020-6292
Product - SAP Disclosure Management; Version - 1.0
Medium
6.3
2917743 [CVE-2020-6281] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(BI Launch pad)
Product - SAP Business Objects Business Intelligence Platform (BI Launchpad); Version - 4.2
Medium
6.1
2849967 [CVE-2020-6276] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Bipodata)
Product - SAP Business Objects Business Intelligence Platform (bipodata); Version - 4.2
Medium
6.1
2896025 [CVE-2020-6282] Server-Side Request Forgery in SAP NetWeaver AS JAVA (IIOP service)
Product - SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE); Versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
Product - SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS); Versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
Medium
5.8
2912708 [CVE-2020-6278] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)
Product - SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC); Versions - 4.1, 4.2
Medium
5.4
2880804 Update to Security Note released on April 2020 Patch Day:[CVE-2020-6222] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Product - SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), Versions - 4.1, 4.2
Medium
5.4
2927373 [CVE-2020-6280] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform
Product - SAP NetWeaver (ABAP Server) and ABAP Platform; Versions - 731, 740, 750
Low
2.7

Source

Posted by

Christoph Nagy
Share on linkedin
Share on twitter
Share on email
SAP Security Comparison Report

Download the Product Comparison Report and understand that holistic security for SAP can be delivered by a single solution.

Find recent Security Advisories for SAP©
Webinar SAP patch
The webinar, taking place on 05.10.2022, is all about SAP Patch Management and its challenges. The German-speaking SAP User Group (DSAG) and the American colleagues of ASUG asked why SAP security patching cannot be as simple and effective as, for example, Windows updates.
S/4HANA migration
SAP Cybersecurity- SAP Security Automation- Security News
“There are a few constants in life” – a statement that also applies to the SAP user community. It has always been a challenge for SAP customers to bring their large SAP environments to a current release level. Although the vendor has done a lot in the past to simplify this, it is still not a complex undertaking.
SecurityBridge
Here at SecurityBridge, we are extremely lucky to have a team full of amazing professionals. Thanks to our team, we have achieved extraordinary things in the past couple of years. With that in mind, we thought it was time for us to start introducing you to the team that drives everything behind the scenes. And we couldn't have chosen a better example to start with than our very own, Harish Dahima! Read on and learn all about Harish's life as a Senior Product Developer, his role, and life at SecurityBridge.
SAP Cloud Connector
SAP Cloud Security- SAP Cybersecurity- Security News
Every organization constantly faces the challenge of minimizing the attack surface that an adversary could use to perform malicious operations. To do this, administrators must install the deployed components and understand them in detail to identify risks and proactively mitigate or prevent those. Today we are looking at what is necessary to protect the SAP Cloud Connector.