Skip to content
Linkedin Twitter Facebook Xing
< Back to Overview

SAP Security Patch Day – February 2022

SAP security Patch day

It seems like a bizarre coincidence that today, February 8th, is not only the second SAP Security Patch Day of the year but it is also Safe Internet Day! SAP is contributing to this by reporting serious security problems in the SAP Web Dispatcher that allow an attacker to attach malicious requests.

SAP fixes a series of HotNews and High vulnerabilities

The vulnerability described in 3123396 (Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server, and SAP Web Dispatcher) requires immediate attention! The flaw gives the attacker the opportunity to impersonate the victim. Since SAP Web Dispatcher and SAP Internet Communication Manager (ICM) in SAP NetWeaver Application Server use the same source code, we strongly recommend that you also patch your systems that have an active instance of SAP ICM.

SecurityBridge customers benefit through updated signatures and tools which allow a quick validation of the Kernel and Web Dispatcher versions across all SAP systems in the landscape.

You can also find more information in the following blog post: How to secure the SAP Internet Communication Manager (SAP ICM)?

A similar vulnerability that “only” received priority High was also patched in SAP NetWeaver Application Server Java published in note 3123427 (HTTP Request Smuggling in SAP NetWeaver Application Server Java).

All SecurityBridge customers have the possibility to continuously check their attack surface. Knowing your attack surface is a critical advantage in the fight against cyberattacks. In this blog post, we explain why: Understand And Reduce The Attack Surface

Log4j also continues to leave its footprint in the February patch release. HotNews fixes for Log4j were published for the SAP Commerce product and also for SAP Data Intelligence 3 (on-premise). If you don’t want to miss any information about Log4j and SAP follow our Log4j – Newsticker.

SAP writes “On 8th of February 2022, SAP Security Patch Day saw the release of 13 new Security Notes. 1 security note was released out-of-band.”. We count 5 additional updates to previously released SAP Security Patches. You can find the full list below.

Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.

Request a Demo

Summary by Severity

The February release contains a total of 17 patches for the following severities:

Severity Number
Hot News
 8
High
 3
Medium
 6
Note Description Severity CVSS
3123396 [CVE-2022-22536] Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server and SAP Web Dispatcher                             
Product - SAP Web Dispatcher, Versions - 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87
Product - SAP Content Server, Version - 7.53
Product - SAP NetWeaver and ABAP Platform, Versions - KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49
Hot News
 10
3142773 [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP CommerceRelated CVEs - CVE-2021-45046, CVE-2021-45105, CVE-2021-44832
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
Hot News
 10
3130920 Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Data Intelligence 3 (on-premise)Related CVEs - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105
Product - SAP Data Intelligence, Version - 3
Hot News
 10
3132922 Update to Security Note released in December 2021:[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Internet of Things Edge PlatformRelated CVEs -  CVE-2021-45105, CVE-2021-45046 , CVE-2021-44832
Product - Internet of Things Edge Platform, Version - 4.0
Hot News
 10
3133772 Update to Security Note released in December 2021:[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Customer CheckoutRelated CVEs - CVE-2021-45046, CVE-2021-45105
Product - SAP Customer Checkout, Version - 2
Hot News
 10
3131047 Update to Security Note released in December 2021:[CVE-2021-44228] Central Security Note for Remote Code Execution vulnerability associated with Apache Log4j 2 component
Hot News
 10
2622660 Update to Security Note released on April 2018 Patch Day:Security updates for the browser control Google Chromium delivered with SAP Business ClientProduct – SAP Business Client, Version – 6.5
Hot News
 10
3140940 [CVE-2022-22544] Missing segregation of duties in SAP Solution Manager Diagnostics Root Cause Analysis Tools
Product - SAP Solution Manager (Diagnostics Root Cause Analysis Tools), Version - 720
Hot News
 9.1
3112928 Update to Security Note released on January 2022 Patch Day:[CVE-2022-22531] Multiple vulnerabilities in F0743 Create Single Payment application of SAP S/4HANAAdditional CVE - CVE-2022-22530
Product - SAP S/4HANA, Versions - 100, 101, 102, 103, 104, 105, 106
High
 8.7
3123427 [CVE-2022-22532] HTTP Request Smuggling in SAP NetWeaver Application Server Java
Product - SAP NetWeaver Application Server Java, Versions - KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53
High
 8.1
3140587 [CVE-2022-22540] SQL Injection vulnerability in SAP NetWeaver AS ABAP (Workplace Server)
Product - SAP NetWeaver AS ABAP (Workplace Server), Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787
High
 7.1
3124994 [CVE-2022-22534] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver
Product - SAP NetWeaver (ABAP and Java application Servers), Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756
Medium
 4.7
3126489 [CVE-2022-22535] Missing Authorization check in SAP ERP HCM
Product -  SAP ERP HCM (Portugal), Versions - 600, 604, 608
Medium
 6.5
3126748 [CVE-2022-22546] XSS vulnerability in SAP Business Objects Web Intelligence (BI Launchpad)
Product - SAP Business Objects Web Intelligence (BI Launchpad) , Version - 420
Medium
 5.4
3134684 [Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise ViewerCVEs - CVE-2022-22537, CVE-2022-22539, CVE-2022-22538
Product - SAP 3D Visual Enterprise Viewer , Version - 9.0
Medium
 4.3
3140564 [CVE-2022-22528] Information Disclosure in SAP Adaptive Server Enterprise
Product - SAP Adaptive Server Enterprise , Version - 16.0
Medium
 5.6
3142092 [CVE-2022-22542] Information Disclosure vulnerability in SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)
Product - SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)  , Versions - 104, 105, 106
Medium
 6.5
3116223 [CVE-2022-22543] Denial of service (DOS) in SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)
Product -  SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) , Versions - KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49
Low
 3.7

Source

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©
View Advisory for Jan'22
White Paper - Bridging the Gap How SecurityBridge Supports NIST CSF in SAP Environments
Download the White Paper “Bridging the Gap – How SecurityBridge Supports NIST CSF in SAP Environments”. Learn how choosing the right tool can significantly shorten the journey of NIST CSF adoption and improve the security posture of SAP environments.
DSAG Jahreskongress 2023

DSAG-Jahreskongress 2023

Alles verändert sich, nichts bleibt wie es ist, die heutige Zeit setzt Flexibilität voraus. Entsprechend wandelbar präsentieren sich DSAG, SAP und das gesamte Ökosystem. Diese Wandlungsfähigkeit steht auch im Fokus des DSAG-Jahreskongress 2023 vom 19.-21. September 2023 in Bremen. Unter dem Motto „Wunderbar wandelbar – Gemeinsam neue Perspektiven schaffen“ freut sich die DSAG wieder darauf, mehr als 5.000 Teilnehmende zu begrüßen. Wagen Sie gemeinsam mit der Interessenvertretung den Blick durch das Kaleidoskop und finden Sie den richtigen Dreh, um zu neuen Blickwinkeln zu gelangen und Veränderungen zu gestalten.
Learn more
SAP security Patch day

SAP Security Patch Day – May 2023

SAP Security Patch Day
Today is another SAP Security Patch Day. In May 2023, the SAP Response Team released 20 SAP Security Notes, including Evergreen 2622660 Security updates for the browser control Google Chromium delivered with SAP Business Client with HotNews priority. Besides two updated Notes, SAP Security Patch Day May 2023, contains 18 new security updates for the vast SAP Product portfolio while the majority relates to SAP Business Objects.
SAP ABAP Directory Traversal Vulnerability

SAP ABAP Directory Traversal Vulnerability: Risks and Solutions

SAP Vulnerability
SAP developers know that ABAP/4 (Advanced Business Application Programming) is not immune to security vulnerabilities like any other programming language. One significant security risk associated with SAP ABAP is directory traversal vulnerability. In this blog post, we will discuss what a directory traversal vulnerability is, why it is a problem for SAP customers, how it can be exploited, and what measures to take to prevent it.