SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web
SAP released a monthly Security Patch Day update addressing four critical vulnerabilities, all rated at the maximum CVSS score of 10.0. The flaws affect three components of the SAP NetWeaver application server and one in the Web Dispatcher. The Web Dispatcher and Internet Communication Manager (ICM) flaws could enable an attacker to execute code remotely if they can access the software over the network.
The ICM flaw allows an attacker to log in as any user on certain systems with SAML single sign-on. The SAP Gateway flaw could allow an attacker to impersonate one of the system's servers and perform unauthorized actions. None of the vulnerabilities require user interaction to exploit. SAP urges users to apply the patches promptly, available in SAP for Me.
RedRays, a security firm, recommends updating the kernel and all Web Dispatchers in a single rollout, covering all fixes for this month.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
