Skip to content

SAP Security Patch Day – December 2021

SAP security Patch day

Today is SAP Security Patch Day! For the last time in 2021, SAP released monthly security updates. Currently, the IT world is in turmoil as earlier this week various information security authorities have drawn attention to a widespread vulnerability called log4j

Log4j - Zero-Day vulnerability for SAP?

From the BSI to the US-CERT, authorities issued warnings for log4j, a high severity zero-day vulnerability.

SAP customers are worried and are wondering to what extent the critical business applications of SAP SE are affected. The extent of the spread of the vulnerability became clear, even the popular open-source application Apache is affected.

The news about the new vulnerability certainly hit SAP like a bomb. Many customers immediately inquired and SAP is responding promptly. In the meantime, more than 200 Notes (requires login) have been published by SAP, and many of these notes confirm that specific products are not affected. 

Stay tuned and read regular updates on the Log4j zero day vulnerability - how it can affect your SAP systems, and what you can do to protect your IT infrastructure

SAP did not create all log4j notes in the category “security”. This means that the December release of the SAP Security Patch Day does not list all notes that contain information about the log4j – Zero-Day Vulnerability within SAP products.

The list below shows a few product-specific notes, but SAP may release further notes at any time:
– SAP HANA Advanced Version XS (note 3130698) and
– SAP CC PoS and SAP CC manager – versions 2.0 FP09, 2.0 FP10, 2.0 FP11 PL06 (or lower) and 2.0 FP12 PL04 (or lower) are affected (note 3130499)
– SAP Commerce Platform (All versions) Apache on-premise (note 3130967)
– Database related, Db2 LUW impacted by log4j vulnerability (note 3130882)

Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.

Summary by Severity

The December release contains a total of 15 patches for the following severities:

Severity Number
Hot News
5
High
5
Medium
5
Note Description Severity CVSS
3130698 [CVE-2021-44228] Remediating log4j CVE-2021-44228 vulnerability in XS Advanced Platform and applications - Product XS Advanced for HANA Platform 2.0 Versions - SPS05, SPS06
Hot News
10
2622660 Update to Security Note released on  Patch Day:Security updates for the browser control Google Chromium delivered with SAP Business ClientProduct – SAP Business Client, Version – 6.5
Hot News
10
3109577 Code Execution vulnerability in SAP Commerce, localization for ChinaRelated CVEs - CVE-2021-21341,CVE-2021-21342,CVE-2021-21349,CVE-2021-21343,CVE-2021-21344,CVE-2021-21346,CVE-2021-21347,CVE-2021-21350,CVE-2021-21351,CVE-2021-21345,CVE-2021-21348
Product - SAP Commerce, localization for China, Version - 2001
Hot News
9.9
3119365 [CVE-2021-44231] Code Injection vulnerability in SAP ABAP Server & ABAP Platform (Translation Tools)
Product - SAP ABAP Server & ABAP Platform (Translation Tools), Versions - 701, 740,750,751,752,753,754,755,756,804
Hot News
9.9
3089831 Update to Security Note released on September 2021 Patch Day:[CVE-2021-38176] SQL Injection vulnerability in SAP NZDT Mapping Table Framework
Product - SAP S/4HANA, Versions - 1511, 1610, 1709, 1809, 1909, 2020, 2021
Product - SAP LT Replication Server, Versions - 2.0, 3.0 
Product - SAP LTRS for S/4HANA, Version - 1.0
Product - SAP Test Data Migration Server, Version - 4.0
Product - SAP Landscape Transformation, Version - 2.0
Hot News
9.9
3114134 [CVE-2021-42064] SQL Injection vulnerability in SAP Commerce
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
High
8.8
3102769 [CVE-2021-42063] Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse
Product - SAP Knowledge Warehouse, Versions - 7.30, 7.31, 7.40, 7.50
High
8.8
3123196 [CVE-2021-44235] Code Injection vulnerability in utility class for SAP NetWeaver AS ABAP
Product - SAP NetWeaver AS ABAP, Versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756
High
8.4
3124094 [CVE-2021-44232] Directory Traversal vulnerability in SAF-T Framework
Product - SAF-T Framework, Versions - SAP_FIN 617, 618, 720, 730, SAP_APPL 600, 602, 603, 604, 605, 606, S4CORE 102, 103, 104, 105
High
7.7
3113593 Denial of service (DOS) in SAP CommerceRelated CVE - CVE-2021-37714
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
High
7.5
3101299 [CVE-2021-42066] Information Disclosure vulnerability in SAP Business One
Product - SAP Business One, Version - 10
Medium
6.6
3000663 Update to Security Note released on July 2021 Patch Day:[CVE-2021-33683] HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager
Product - SAP Web Dispatcher and Internet Communication Manager, Versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83
Medium
5.4
3121165 [Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise ViewerCVEs - CVE-2021-42068,CVE-2021-42070, CVE-2021-42069, CVE-2021-42069
Product - SAP 3D Visual Enterprise Viewer, Version - 9
Medium
4.3
2843016 Update to Security Note released on November 2019 Patch Day:[CVE-2019-0388] Content spoofing vulnerability in UI5 HTTP Handler
Product - SAP UI, Versions - 7.5, 7.51, 7.52, 7.53, 7.54
Product - SAP UI 700, Versions - 2.0
Medium
4.3
3103677 [CVE-2021-42061] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (Web Intelligence)
Product - SAP BusinessObjects Business Intelligence Platform, Version - 420
Medium
4.1
3080816 [CVE-2021-44233] Missing Authorization check in GRC Access Control
Product - SAP GRC Access Control, Versions - V1100_700, V1100_731, V1200_750
Low
2.4

Source

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©
Download the White Paper “Bridging the Gap – How SecurityBridge Supports NIST CSF in SAP Environments”. Learn how choosing the right tool can significantly shorten the journey of NIST CSF adoption and improve the security posture of SAP environments.

Webcast – Protect your SAP from Ransomware Attacks

We cordially invite you to participate in our webcast on April 10th at 14:30 CET. This exclusive event is a joint initiative of SecurityBridge in cooperation with BowBridge and Log2 and will allow you to listen to exciting insights from top-class experts.
SAP system main
SAP Cybersecurity- SAP Vulnerability
This article highlights the importance of securing the 3 layers of an SAP system to prevent unauthorized access to critical business data.
NIST 2.0
Let’s be brutally honest: No one really cares about Vulnerability Management... Until they are impacted by a vulnerability exploit! We are always personally affected when an exploit negatively influences our finances, our privacy, our jobs, our careers, or even the size of our future paychecks.
SAP Security Patch Tuesday 2024
SAP Security Patch Day
For March 2024, 10 new Security Notes have been released and 2 have been updated. Let's look at some highlights, starting with the 'HotNews' notes.