Skip to content

SAP Security Patch Day – December 2021

SAP security Patch day

Today is SAP Security Patch Day! For the last time in 2021, SAP released monthly security updates. Currently, the IT world is in turmoil as earlier this week various information security authorities have drawn attention to a widespread vulnerability called log4j

Log4j - Zero-Day vulnerability for SAP?

From the BSI to the US-CERT, authorities issued warnings for log4j, a high severity zero-day vulnerability.

SAP customers are worried and are wondering to what extent the critical business applications of SAP SE are affected. The extent of the spread of the vulnerability became clear, even the popular open-source application Apache is affected.

The news about the new vulnerability certainly hit SAP like a bomb. Many customers immediately inquired and SAP is responding promptly. In the meantime, more than 200 Notes (requires login) have been published by SAP, and many of these notes confirm that specific products are not affected. 

Stay tuned and read regular updates on the Log4j zero day vulnerability - how it can affect your SAP systems, and what you can do to protect your IT infrastructure

SAP did not create all log4j notes in the category “security”. This means that the December release of the SAP Security Patch Day does not list all notes that contain information about the log4j – Zero-Day Vulnerability within SAP products.

The list below shows a few product-specific notes, but SAP may release further notes at any time:
– SAP HANA Advanced Version XS (note 3130698) and
– SAP CC PoS and SAP CC manager – versions 2.0 FP09, 2.0 FP10, 2.0 FP11 PL06 (or lower) and 2.0 FP12 PL04 (or lower) are affected (note 3130499)
– SAP Commerce Platform (All versions) Apache on-premise (note 3130967)
– Database related, Db2 LUW impacted by log4j vulnerability (note 3130882)

Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.

Summary by Severity

The December release contains a total of 15 patches for the following severities:

Severity Number
Hot News
Note Description Severity CVSS
3130698 [CVE-2021-44228] Remediating log4j CVE-2021-44228 vulnerability in XS Advanced Platform and applications - Product XS Advanced for HANA Platform 2.0 Versions - SPS05, SPS06
Hot News
2622660 Update to Security Note released on  Patch Day:Security updates for the browser control Google Chromium delivered with SAP Business ClientProduct – SAP Business Client, Version – 6.5
Hot News
3109577 Code Execution vulnerability in SAP Commerce, localization for ChinaRelated CVEs - CVE-2021-21341,CVE-2021-21342,CVE-2021-21349,CVE-2021-21343,CVE-2021-21344,CVE-2021-21346,CVE-2021-21347,CVE-2021-21350,CVE-2021-21351,CVE-2021-21345,CVE-2021-21348
Product - SAP Commerce, localization for China, Version - 2001
Hot News
3119365 [CVE-2021-44231] Code Injection vulnerability in SAP ABAP Server & ABAP Platform (Translation Tools)
Product - SAP ABAP Server & ABAP Platform (Translation Tools), Versions - 701, 740,750,751,752,753,754,755,756,804
Hot News
3089831 Update to Security Note released on September 2021 Patch Day:[CVE-2021-38176] SQL Injection vulnerability in SAP NZDT Mapping Table Framework
Product - SAP S/4HANA, Versions - 1511, 1610, 1709, 1809, 1909, 2020, 2021
Product - SAP LT Replication Server, Versions - 2.0, 3.0 
Product - SAP LTRS for S/4HANA, Version - 1.0
Product - SAP Test Data Migration Server, Version - 4.0
Product - SAP Landscape Transformation, Version - 2.0
Hot News
3114134 [CVE-2021-42064] SQL Injection vulnerability in SAP Commerce
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
3102769 [CVE-2021-42063] Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse
Product - SAP Knowledge Warehouse, Versions - 7.30, 7.31, 7.40, 7.50
3123196 [CVE-2021-44235] Code Injection vulnerability in utility class for SAP NetWeaver AS ABAP
Product - SAP NetWeaver AS ABAP, Versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756
3124094 [CVE-2021-44232] Directory Traversal vulnerability in SAF-T Framework
Product - SAF-T Framework, Versions - SAP_FIN 617, 618, 720, 730, SAP_APPL 600, 602, 603, 604, 605, 606, S4CORE 102, 103, 104, 105
3113593 Denial of service (DOS) in SAP CommerceRelated CVE - CVE-2021-37714
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
3101299 [CVE-2021-42066] Information Disclosure vulnerability in SAP Business One
Product - SAP Business One, Version - 10
3000663 Update to Security Note released on July 2021 Patch Day:[CVE-2021-33683] HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager
Product - SAP Web Dispatcher and Internet Communication Manager, Versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83
3121165 [Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise ViewerCVEs - CVE-2021-42068,CVE-2021-42070, CVE-2021-42069, CVE-2021-42069
Product - SAP 3D Visual Enterprise Viewer, Version - 9
2843016 Update to Security Note released on November 2019 Patch Day:[CVE-2019-0388] Content spoofing vulnerability in UI5 HTTP Handler
Product - SAP UI, Versions - 7.5, 7.51, 7.52, 7.53, 7.54
Product - SAP UI 700, Versions - 2.0
3103677 [CVE-2021-42061] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (Web Intelligence)
Product - SAP BusinessObjects Business Intelligence Platform, Version - 420
3080816 [CVE-2021-44233] Missing Authorization check in GRC Access Control
Product - SAP GRC Access Control, Versions - V1100_700, V1100_731, V1200_750


Posted by

Christoph Nagy
Find recent Security Advisories for SAP©
Download the White Paper “Bridging the Gap – How SecurityBridge Supports NIST CSF in SAP Environments”. Learn how choosing the right tool can significantly shorten the journey of NIST CSF adoption and improve the security posture of SAP environments.

DSAG-Jahreskongress 2023

Alles verändert sich, nichts bleibt wie es ist, die heutige Zeit setzt Flexibilität voraus. Entsprechend wandelbar präsentieren sich DSAG, SAP und das gesamte Ökosystem. Diese Wandlungsfähigkeit steht auch im Fokus des DSAG-Jahreskongress 2023 vom 19.-21. September 2023 in Bremen. Unter dem Motto „Wunderbar wandelbar – Gemeinsam neue Perspektiven schaffen“ freut sich die DSAG wieder darauf, mehr als 5.000 Teilnehmende zu begrüßen. Wagen Sie gemeinsam mit der Interessenvertretung den Blick durch das Kaleidoskop und finden Sie den richtigen Dreh, um zu neuen Blickwinkeln zu gelangen und Veränderungen zu gestalten.
SAP security Patch day
SAP Security Patch Day
Today is another SAP Security Patch Day. In May 2023, the SAP Response Team released 20 SAP Security Notes, including Evergreen 2622660 Security updates for the browser control Google Chromium delivered with SAP Business Client with HotNews priority. Besides two updated Notes, SAP Security Patch Day May 2023, contains 18 new security updates for the vast SAP Product portfolio while the majority relates to SAP Business Objects.
SAP ABAP Directory Traversal Vulnerability
SAP developers know that ABAP/4 (Advanced Business Application Programming) is not immune to security vulnerabilities like any other programming language. One significant security risk associated with SAP ABAP is directory traversal vulnerability. In this blog post, we will discuss what a directory traversal vulnerability is, why it is a problem for SAP customers, how it can be exploited, and what measures to take to prevent it.
we are hiring - career page
SecurityBridge is a leading provider of cutting-edge cybersecurity for SAP, catering to businesses of all sizes. We are expanding our operation to the US market and are looking for an experienced Sales Representative to join our team. The ideal candidate will have at least 5 years of experience in sales, with a focus on software sales, SAP security, and cybersecurity.