Vulnerabilities fixed in SAP products

🗓️ 14 Jan 2025 11:50:16Reported by NCSCType

SAP fixed vulnerabilities in ABAP and ABAP Platform, including weak auth, access controls, privilege escalation, SQL injection, and cross-site scripting.

Reporter	Title	Published	Views	Family All 149
BDU FSTEC	The vulnerability of the software for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP lies in the improper assignment of permissions to critical resources. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	14 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software for developing and executing applications in the ABAP language of SAP NetWeaver Application Server ABAP lies in the lack of authentication mechanisms. This allows attackers to disclose sensitive information that should be protected.	20 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of SAP NetWeaver AS Java software integration platforms lies in the unlimited loading of dangerous files, which allows attackers to execute cross-site scripting attacks.	20 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of SAP NetWeaver Application Server ABAP and ABAP Platform software integration platforms, related to information leakage in error messages, allows attackers to gain unauthorized access to protected information.	20 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SAP GUI graphical user interface for Java allows a perpetrator to gain unauthorized access to protected information.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP lies in the exposure of system data to unauthorized access within the controlled area. This allows attackers to disclose protected information.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP lies in the exposure of system data to unauthorized access within the controlled area. This allows attackers to disclose protected information.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	Vulnerability of the SAP setup tool for simplified installation and configuration. The SAP setup involves an uncontrolled search element, which allows attackers to increase their privileges.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	Vulnerability of automation tools for business processes in SAP Business Workflow and SAP Flexible Workflow systems: The ability to bypass authentication by using a user-controlled key allows unauthorized users to gain unauthorized access to protected information.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP lies in the lack of measures taken to protect the SQL query structure. This allows attackers to execute arbitrary code.	27 Jan 202500:00	–	bdu_fstec

Source	Link
support	www.support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2025.html

14 Jan 2025 11:50Current

8.3High risk

Vulners AI Score8.3

CVSS 3.19.9

EPSS0.00718

SSVC