SAP Security Patch Day – December 2021

SAP Patchday

Today is SAP Security Patch Day! For the last time in 2021, SAP released monthly security updates. Currently, the IT world is in turmoil as earlier this week various information security authorities have drawn attention to a widespread vulnerability called log4j

Log4j - Zero-Day vulnerability for SAP?

From the BSI (link) to the US-CERT (link), authorities issued warnings for log4j, a high severity zero day vulnerability.

SAP customers are worried and are wondering to what extent the critical business applications of SAP SE are affected. The extent of the spread of the vulnerability became clear, even the popular open-source application Apache is affected.

The news about the new vulnerability certainly hit SAP like a bomb. Many customers immediately inquired and SAP is responding promptly. In the meantime, more than 200 Notes (link, requires login) have been published by SAP, many of these notes confirm that specific products are not affected. 

Stay tuned and read regular updates on the Log4j zero day vulnerability - how it can affect your SAP systems, and what you can do to protect your IT infrastructure

SAP did not create all log4j notes in the category “security”. This means that the December release of the SAP Security Patch Day does not list all notes that contain information about the log4j – Zero-Day Vulnerability within SAP products.

The list below shows a few product-specific notes, but SAP may release further notes at any time:
– SAP HANA Advanced Version XS (note 3130698) and
– SAP CC PoS and SAP CC manager – versions 2.0 FP09, 2.0 FP10, 2.0 FP11 PL06 (or lower) and 2.0 FP12 PL04 (or lower) are affected (note 3130499)
– SAP Commerce Platform (All versions) Apache on-premise (note 3130967)
– Database related, Db2 LUW impacted by log4j vulnerability (note 3130882)

Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.

Summary by Severity

The December release contains a total of 15 patches for the following severities:

Severity Number
Hot News
Note Description Severity CVSS
3130698 [CVE-2021-44228] Remediating log4j CVE-2021-44228 vulnerability in XS Advanced Platform and applications - Product XS Advanced for HANA Platform 2.0 Versions - SPS05, SPS06
Hot News
2622660 Update to Security Note released on  Patch Day:Security updates for the browser control Google Chromium delivered with SAP Business ClientProduct – SAP Business Client, Version – 6.5
Hot News
3109577 Code Execution vulnerability in SAP Commerce, localization for ChinaRelated CVEs - CVE-2021-21341,CVE-2021-21342,CVE-2021-21349,CVE-2021-21343,CVE-2021-21344,CVE-2021-21346,CVE-2021-21347,CVE-2021-21350,CVE-2021-21351,CVE-2021-21345,CVE-2021-21348
Product - SAP Commerce, localization for China, Version - 2001
Hot News
3119365 [CVE-2021-44231] Code Injection vulnerability in SAP ABAP Server & ABAP Platform (Translation Tools)
Product - SAP ABAP Server & ABAP Platform (Translation Tools), Versions - 701, 740,750,751,752,753,754,755,756,804
Hot News
3089831 Update to Security Note released on September 2021 Patch Day:[CVE-2021-38176] SQL Injection vulnerability in SAP NZDT Mapping Table Framework
Product - SAP S/4HANA, Versions - 1511, 1610, 1709, 1809, 1909, 2020, 2021
Product - SAP LT Replication Server, Versions - 2.0, 3.0 
Product - SAP LTRS for S/4HANA, Version - 1.0
Product - SAP Test Data Migration Server, Version - 4.0
Product - SAP Landscape Transformation, Version - 2.0
Hot News
3114134 [CVE-2021-42064] SQL Injection vulnerability in SAP Commerce
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
3102769 [CVE-2021-42063] Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse
Product - SAP Knowledge Warehouse, Versions - 7.30, 7.31, 7.40, 7.50
3123196 [CVE-2021-44235] Code Injection vulnerability in utility class for SAP NetWeaver AS ABAP
Product - SAP NetWeaver AS ABAP, Versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756
3124094 [CVE-2021-44232] Directory Traversal vulnerability in SAF-T Framework
Product - SAF-T Framework, Versions - SAP_FIN 617, 618, 720, 730, SAP_APPL 600, 602, 603, 604, 605, 606, S4CORE 102, 103, 104, 105
3113593 Denial of service (DOS) in SAP CommerceRelated CVE - CVE-2021-37714
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
3101299 [CVE-2021-42066] Information Disclosure vulnerability in SAP Business One
Product - SAP Business One, Version - 10
3000663 Update to Security Note released on July 2021 Patch Day:[CVE-2021-33683] HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager
Product - SAP Web Dispatcher and Internet Communication Manager, Versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83
3121165 [Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise ViewerCVEs - CVE-2021-42068,CVE-2021-42070, CVE-2021-42069, CVE-2021-42069
Product - SAP 3D Visual Enterprise Viewer, Version - 9
2843016 Update to Security Note released on November 2019 Patch Day:[CVE-2019-0388] Content spoofing vulnerability in UI5 HTTP Handler
Product - SAP UI, Versions - 7.5, 7.51, 7.52, 7.53, 7.54
Product - SAP UI 700, Versions - 2.0
3103677 [CVE-2021-42061] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (Web Intelligence)
Product - SAP BusinessObjects Business Intelligence Platform, Version - 420
3080816 [CVE-2021-44233] Missing Authorization check in GRC Access Control
Product - SAP GRC Access Control, Versions - V1100_700, V1100_731, V1200_750


Posted by

Christoph Nagy
Share on linkedin
Share on twitter
Share on email
Find recent Security Advisories for SAP©
Download the White Paper “YOUR ROAD TO SAP SECURITY” to learn about the major milestones towards increasing the cybersecurity posture of your SAP systems.

Meet us at ASUG Carolinas Chapter Meeting 2022

Come and meet us! On June 24, 2022 the US team of SecurityBridge will be at the ASUG Carolinas Chapter Meeting 2022. We are silver sponsor of the event and present with an exhibition table.
The Federal Republic is attempting to make critical infrastructure resilient to cyber-attacks by proactively identifying vulnerabilities and implementing measures to protect attractive targets.
how to spot anomalies in SAP
How to reliably detect suspicious actions from within the huge mass of SAP systems and user activity? In this article, we’ll tell you what’s needed to detect anomalies in SAP's log stack and put them into context to find cyber-attacks.