Skip to content
Linkedin Twitter Facebook Xing
< Back to Overview

SAP Security Patch Day – March 2022

SAP security Patch day

Today, March 8th, 2022, is again Patch Day. SAP released security updates for the comprehensive SAP product portfolio. This month’s release counts 16 security patches, including the notes that have been updated.

SAP Security Patches - March 2022

During this March Patch Day, SAP is again releasing critical security patches. Among the 4 security updates with priority Hot News are 2 new advisories that deal with a remote code execution (RCE) vulnerability in SAP Work Manager and a missing authentication check in SAP Focused Run. The first update is vulnerability note 3123396, which was already published in February and allows an attacker to attack the SAP Web DISPATCHER and the SAP Content Server via http smuggling.

The second SAP security patch is Note 3131047. The note holds the summary of all Log4J related issues existing across all SAP products. It is advisable to regularly check this note and take all necessary precautions. Customers of the SecurityBridge platform have a key benefit, the patch management capabilities notify on missing security updates.

The SAP Fiori Launchpad has also received a security correction. The possibility of an attack via XSS is prevented with 3149805. Customers using SAP NetWeaver versions 754, 755, 756 should definitely install the fix, even though the severity is only rated as “High”.

As a side note, as of March the SAP Response Team changed the platform for their monthly publications. The platform shift was already announced in February with the following message “Going forward SAP Security Patch Day blogs will be published here: dam.sap.com”.

Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.

Request a Demo

Summary by Severity

The March release contains a total of 16 patches for the following severities:

Severity Number
Hot News
 4
High
 1
Medium
 10
Low
 1
Note Description Severity CVSS
3123396 Update to Security Note released on February 2022 Patch Day:[CVE-2022-22536] Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server and SAP Web DispatcherProduct-SAP Web Dispatcher, Versions -7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87Product-SAP Content Server, Version -7.53Product-SAP NetWeaver and ABAP Platform, Versions -KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49
Hot News
 10
3131047 Update to Security Note released on December 2021 Patch Day:[CVE-2021-44228] Central Security Note for Remote Code Execution vulnerability associated with Apache Log4j 2 component
Hot News
 10
3154684 [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Work ManagerAdditional CVE-CVE-2021-45046,CVE-2021-45105,CVE-2021-44832 Product-SAP Work Manager, Versions 6.4, 6.5, 6.6 Product-SAP Inventory Manager, Versions 4.3, 4.4
Hot News
 10
3145987 [CVE-2022-24396] Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0)Product-Simple Diagnostics Agent
Hot News
 9.3
3149805 [CVE-2022-26101] Cross-Site Scripting (XSS) vulnerability in SAP Fiori launchpadProduct-Fiori Launchpad, Versions 754, 755, 75
High
 8.2
1753378 Update to Security Note released on August 2013 Patch Day:Directory traversal in Web ContainerProduct-SAP-JEE, Version 6.40 Product-SAP-JEECOR, Versions 6.40, 7.00, 7.01Product-SERVERCORE, Versions 7.10, 7.11, 7.20, 7.30, 7.31
Medium
 5.3
3142092 Update to Security Note released on February 2022 Patch Day:[CVE-2022-22542] Information Disclosure vulnerability in SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)Product-SAPS/4HANA(Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer), Versions -104, 105, 106
Medium
 6.5
3146261 [CVE-2022-24395] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalProduct-SAP NetWeaver Enterprise Portal, Versions7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
Medium
 6.1
3146260 [CVE-2022-24397] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalProduct-SAP NetWeaver Enterprise Portal, Versions 7.30, 7.31, 7.40, 7.50
Medium
 6.1
3144941 [CVE-2022-26104] Missing Authorization check in SAP Financial ConsolidationProduct-SAP Financial Consolidation, Version10.1
Medium
 5.4
3145997 [CVE-2022-26102] Missing authorization check in SAP NetWeaver Application Server for ABAP Product-SAP NetWeaver Application Server for ABAP, Versions700, 701, 702, 731
Medium
 5.4
3147283 [CVE-2022-24399]Cross-Site Scripting (XSS) vulnerability in SAP Focused Run (Real User Monitoring)Product-SAP Focused Run, Versions 200, 300
Medium
 5.4
3147102 [CVE-2022-22547] Information Disclosure vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0)Product-Simple Diagnostics Agent, Versions=>1.0, < 1.58
Medium
 5.3
3103424 [CVE-2022-24398] Information Disclosure vulnerability in SAP Business Objects Business Intelligence PlatformProduct-SAP Business Objects Business Intelligence Platform, Version420, 430
Medium
 5.0
3111110 [CVE-2022-26100] Denial of service (DOS) in SAPCARProduct-SAPCAR, Version7.22
Medium
 4.8
3132360 [CVE-2022-26103] Information Disclosure vulnerability in SAP NetWeaver(Real Time Messaging Framework)Product-SAP NetWeaver AS JAVA (Portal Basis), Version 7.50
Low
 3.7

Source

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©
View Advisory for Feb'22
White Paper - Bridging the Gap How SecurityBridge Supports NIST CSF in SAP Environments
Download the White Paper “Bridging the Gap – How SecurityBridge Supports NIST CSF in SAP Environments”. Learn how choosing the right tool can significantly shorten the journey of NIST CSF adoption and improve the security posture of SAP environments.
DSAG Jahreskongress 2023

DSAG-Jahreskongress 2023

Alles verändert sich, nichts bleibt wie es ist, die heutige Zeit setzt Flexibilität voraus. Entsprechend wandelbar präsentieren sich DSAG, SAP und das gesamte Ökosystem. Diese Wandlungsfähigkeit steht auch im Fokus des DSAG-Jahreskongress 2023 vom 19.-21. September 2023 in Bremen. Unter dem Motto „Wunderbar wandelbar – Gemeinsam neue Perspektiven schaffen“ freut sich die DSAG wieder darauf, mehr als 5.000 Teilnehmende zu begrüßen. Wagen Sie gemeinsam mit der Interessenvertretung den Blick durch das Kaleidoskop und finden Sie den richtigen Dreh, um zu neuen Blickwinkeln zu gelangen und Veränderungen zu gestalten.
Learn more
SAP security Patch day

SAP Security Patch Day – May 2023

SAP Security Patch Day
Today is another SAP Security Patch Day. In May 2023, the SAP Response Team released 20 SAP Security Notes, including Evergreen 2622660 Security updates for the browser control Google Chromium delivered with SAP Business Client with HotNews priority. Besides two updated Notes, SAP Security Patch Day May 2023, contains 18 new security updates for the vast SAP Product portfolio while the majority relates to SAP Business Objects.
SAP ABAP Directory Traversal Vulnerability

SAP ABAP Directory Traversal Vulnerability: Risks and Solutions

SAP Vulnerability
SAP developers know that ABAP/4 (Advanced Business Application Programming) is not immune to security vulnerabilities like any other programming language. One significant security risk associated with SAP ABAP is directory traversal vulnerability. In this blog post, we will discuss what a directory traversal vulnerability is, why it is a problem for SAP customers, how it can be exploited, and what measures to take to prevent it.