Skip to content

SAP Security Patch Day – March 2022

SAP security Patch day

Today, March 8, 2022, SAP again released security updates for the comprehensive SAP product portfolio. This months release counts 16 security patches. This includes the notes that have been updated.

SAP Security Patches of March 2022

In March, SAP is again releasing critical patches. Among the 4 security updates with priority Hot News are 2 new advisories that deal with a remote code execution (RCE) vulnerability in SAP Work Manager and a missing authentication check in SAP Focused Run. The first update is vulnerability note 3123396, which was already published in February and allows an attacker to attack the SAP Web DISPATCHER and the SAP Content Server via http smuggling.

The second SAP security patch is Note 3131047. The note holds the summary of all Log4J related issues existing across all SAP products. It is advisable to regularly check this note and take all necessary precautions. Customers of the SecurityBridge platform have a key benefit, the patch management capabilities notify on missing security updates.

The SAP Fiori Launchpad has also received a security correction. The possibility of an attack via XSS is prevented with 3149805. Customers using SAP NetWeaver versions 754, 755, 756 should definitely install the fix, even though the severity is only rated as “High”.

As a side note, as of March the SAP Response Team changed the platform for their monthly publications. The platform shift was already announced in February with the following message “Going forward SAP Security Patch Day blogs will be published here: dam.sap.com”.

Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.

Summary by Severity

The March release contains a total of 16 patches for the following severities:

SeverityNumber
Hot News
4
High
1
Medium
10
Low
1
NoteDescriptionSeverityCVSS
3123396Update to Security Note released on February 2022 Patch Day:[CVE-2022-22536] Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server and SAP Web DispatcherProduct-SAP Web Dispatcher, Versions -7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87Product-SAP Content Server, Version -7.53Product-SAP NetWeaver and ABAP Platform, Versions -KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49
Hot News
10
3131047Update to Security Note released on December 2021 Patch Day:[CVE-2021-44228] Central Security Note for Remote Code Execution vulnerability associated with Apache Log4j 2 component
Hot News
10
3154684[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Work ManagerAdditional CVE-CVE-2021-45046,CVE-2021-45105,CVE-2021-44832 Product-SAP Work Manager, Versions 6.4, 6.5, 6.6 Product-SAP Inventory Manager, Versions 4.3, 4.4
Hot News
10
3145987[CVE-2022-24396] Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0)Product-Simple Diagnostics Agent
Hot News
9.3
3149805[CVE-2022-26101] Cross-Site Scripting (XSS) vulnerability in SAP Fiori launchpadProduct-Fiori Launchpad, Versions 754, 755, 75
High
8.2
1753378Update to Security Note released on August 2013 Patch Day:Directory traversal in Web ContainerProduct-SAP-JEE, Version 6.40 Product-SAP-JEECOR, Versions 6.40, 7.00, 7.01Product-SERVERCORE, Versions 7.10, 7.11, 7.20, 7.30, 7.31
Medium
5.3
3142092Update to Security Note released on February 2022 Patch Day:[CVE-2022-22542] Information Disclosure vulnerability in SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)Product-SAPS/4HANA(Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer), Versions -104, 105, 106
Medium
6.5
3146261[CVE-2022-24395] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalProduct-SAP NetWeaver Enterprise Portal, Versions7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
Medium
6.1
3146260[CVE-2022-24397] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalProduct-SAP NetWeaver Enterprise Portal, Versions 7.30, 7.31, 7.40, 7.50
Medium
6.1
3144941[CVE-2022-26104] Missing Authorization check in SAP Financial ConsolidationProduct-SAP Financial Consolidation, Version10.1
Medium
5.4
3145997[CVE-2022-26102] Missing authorization check in SAP NetWeaver Application Server for ABAP Product-SAP NetWeaver Application Server for ABAP, Versions700, 701, 702, 731
Medium
5.4
3147283[CVE-2022-24399]Cross-Site Scripting (XSS) vulnerability in SAP Focused Run (Real User Monitoring)Product-SAP Focused Run, Versions 200, 300
Medium
5.4
3147102[CVE-2022-22547] Information Disclosure vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0)Product-Simple Diagnostics Agent, Versions=>1.0, < 1.58
Medium
5.3
3103424[CVE-2022-24398] Information Disclosure vulnerability in SAP Business Objects Business Intelligence PlatformProduct-SAP Business Objects Business Intelligence Platform, Version420, 430
Medium
5.0
3111110[CVE-2022-26100] Denial of service (DOS) in SAPCARProduct-SAPCAR, Version7.22
Medium
4.8
3132360[CVE-2022-26103] Information Disclosure vulnerability in SAP NetWeaver(Real Time Messaging Framework)Product-SAP NetWeaver AS JAVA (Portal Basis), Version 7.50
Low
3.7

Source

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©
Download the White Paper “Which cybersecurity framework is the best fit for SAP application security?” to learn more about the available frameworks, the challenges when adopting a framework, and more.

SecurityBridge at the DSAG Technologietage 2023

SecurityBridge will be attending the DSAG Technologietage 2023 from March 22nd-23rd at the Congress Center Rosengarten in Mannheim.
SAP Cyber risk
SAP Cybersecurity- Security News
Businesses must be more cautious to protect themselves from cyber threats as digitalization and the use of SAP systems increase. SAP S/4HANA is critical for many enterprises as it provides the foundation for business operations. As digitalization and Industry 4.0 continue to increase, SAP S/4HANA lays the foundation for many modern business scenarios. SAP systems are important for many industries and their security is a major concern, making them vulnerable to cyber attackers. This article will discuss cyber risks and how you can assess your individual and organizational SAP systems' risks. What are cyber risks?
Common SAP Patches
SAP Cybersecurity- SAP Patch Management- SAP Security Patch Day- Security News
Installing SAP patches is crucial for maintaining a robust and secure enterprise resource planning (ERP) system. SAP, one of the leading ERP systems in the world, is constantly evolving to meet the changing needs of businesses. As a result, SAP releases various patches to address issues and enhance the functionality of its software. However, installing SAP patches can present challenges for IT teams, such as ensuring minimal disruption to business operations, managing risks, and testing the non-implemented patches. This article will discuss the three most common types of SAP patches- kernel patches, snote patches, and support packs - and the best practices for installing them.
SAP interfaces
SAP Cybersecurity- SAP Interface- Security News
In this blog article, we will explore the importance of SAP interface security and discuss the various measures businesses can take to protect their systems and data. We will also examine some common threats to SAP interfaces and how to mitigate them. To safeguard your business, you need to understand the importance of SAP interface security and take steps to make your interfaces secure. 
SAP security Patch day
10th January 2023 SAP response team sends some Happy New Year greeting to the SAP Security Teams, by releasing 10 SAP Security Notes.