In this release, 3 notes have a ‘high’ priority. SAP note 3434839 describes how the User Management Engine (UME) of a Java system is vulnerable to the functions ‘Self-Registration’ and ‘Modify your own profile’. Looking at this vulnerability, underlines the importance of the ‘security by design’ principle.

SAP notes 3421384 and 3438234 are about different products but they share a common cause for vulnerabilities: insecure handling of file input from the user interface. Many vulnerabilities are related to this and can lead to ‘Path Traversal‘ attacks, for example. Why is this a problem? First, because an ‘attack’ is a problem by definition… But to be concrete: exploitation examples are the disclosure of important information from the application or other components, like the database or operating system. Or the upload of a malicious file that contains code that can be used as the next step of an attack. Very often these kinds of attacks have the potential to cause severe damage!

All three above vulnerabilities can be mitigated either by patching the component or by a workaround. Naturally, patching is recommended, but do consider the workaround if needed (see below).