Refine your search

3 vulnerabilities found for SAP CRM WebClient UI by SAP

CERTFR-2024-AVI-0477
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
SAP S/4HANA (Manage Incoming Payment Files) S/4HANA (Manage Incoming Payment Files) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité
SAP SAP Document Builder Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java version GP-CORE 7.5 sans le dernier correctif de sécurité
SAP NetWeaver Application Server ABAP et ABAP Platform SAP NetWeaver Application Server ABAP et ABAP Platform versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de sécurité
SAP Central Finance Infrastructure Components Central Finance Infrastructure Components versions SAP_FIN 720, 730, SAPSCORE 114, S4CORE 100, 101 et 102 sans le dernier correctif de sécurité
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité
SAP NetWeaver Application Server ABAP et ABAP Platform SAP NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de sécurité
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de sécurité
SAP SAP Financial Consolidation Financial Consolidation version FINANCE 1010 sans le dernier correctif de sécurité
SAP SAP BW/4HANA Transformation et Data Transfer Process BW/4HANA Transformation et Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité
SAP SAP Student Life Cycle Management Student Life Cycle Management versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité
SAP SAP CRM WebClient UI CRM WebClient UI versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité
References
Bulletin de sécurité SAP june-2024 2024-06-11 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "S/4HANA (Manage Incoming Payment Files) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S/4HANA (Manage Incoming Payment Files)",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP Document Builder",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java version GP-CORE 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Central Finance Infrastructure Components versions SAP_FIN 720, 730, SAPSCORE 114, S4CORE 100, 101 et 102 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Central Finance Infrastructure Components",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Financial Consolidation version FINANCE 1010 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP Financial Consolidation",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BW/4HANA Transformation et Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP BW/4HANA Transformation et Data Transfer Process",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Student Life Cycle Management versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP Student Life Cycle Management",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "CRM WebClient UI versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP CRM WebClient UI",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-37176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37176"
    },
    {
      "name": "CVE-2024-34691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34691"
    },
    {
      "name": "CVE-2024-37177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37177"
    },
    {
      "name": "CVE-2024-34686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34686"
    },
    {
      "name": "CVE-2024-34683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
    },
    {
      "name": "CVE-2024-34688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34688"
    },
    {
      "name": "CVE-2024-32733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-32733"
    },
    {
      "name": "CVE-2024-34684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34684"
    },
    {
      "name": "CVE-2024-33001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-33001"
    },
    {
      "name": "CVE-2024-34690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34690"
    },
    {
      "name": "CVE-2024-28164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28164"
    }
  ],
  "initial_release_date": "2024-06-11T00:00:00",
  "last_revision_date": "2024-06-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0477",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2024-06-11",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP june-2024",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2024.html"
    }
  ]
}

CERTFR-2024-AVI-0125
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702
SAP N/A SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731
SAP N/A SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java (Guided Procedures) version 7.50
SAP N/A SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804
SAP N/A SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53
SAP N/A SAP Business Client versions 6.5, 7.0 et 7.70
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java (User Admin Application) version 7.50
SAP N/A SAP Cloud Connector version 2.0
SAP N/A SAP Fiori app ("My Overtime Requests") versions 605
SAP N/A IDES Systems toutes versions
SAP N/A SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I
SAP N/A SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758
SAP N/A BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101
SAP N/A SAP Companion versions antérieures à 3.1.38
SAP SAP CRM WebClient UI SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java (Guided Procedures) version 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client versions 6.5, 7.0 et 7.70",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java (User Admin Application) version 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Cloud Connector version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Fiori app (\"My Overtime Requests\") versions 605",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "IDES Systems toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Companion versions ant\u00e9rieures \u00e0 3.1.38",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
      "product": {
        "name": "SAP CRM WebClient UI",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-24741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24741"
    },
    {
      "name": "CVE-2024-22132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22132"
    },
    {
      "name": "CVE-2024-24739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24739"
    },
    {
      "name": "CVE-2023-49580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49580"
    },
    {
      "name": "CVE-2024-25643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25643"
    },
    {
      "name": "CVE-2024-24742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24742"
    },
    {
      "name": "CVE-2024-25642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25642"
    },
    {
      "name": "CVE-2024-24740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24740"
    },
    {
      "name": "CVE-2024-22129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22129"
    },
    {
      "name": "CVE-2024-22126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22126"
    },
    {
      "name": "CVE-2024-22128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22128"
    },
    {
      "name": "CVE-2024-22131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22131"
    },
    {
      "name": "CVE-2024-22130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22130"
    },
    {
      "name": "CVE-2023-49058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49058"
    },
    {
      "name": "CVE-2024-24743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24743"
    }
  ],
  "initial_release_date": "2024-02-14T00:00:00",
  "last_revision_date": "2024-02-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0125",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SAP. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP february-2024 du 13 f\u00e9vrier 2024",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2024.html"
    }
  ]
}

CERTFR-2023-AVI-0369
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP 3D Visual Enterprise License Manager version 15
SAP N/A SAP Commerce versions 2211, 2105 et 2205
SAP N/A SAP Application Interface Framework (ODATA service) versions 755 et 756
SAP N/A SAP Commerce (Backoffice) versions 2105 et 2205
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform versions 420 et 430
SAP SAP CRM WebClient UI SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80
SAP N/A SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 20
SAP N/A SAP GUI pour Windows versions 7.70 et 8.0
SAP N/A SAP IBP EXCEL ADD-IN versions 2211, 2302 et 2305
SAP N/A SAP BusinessObjects Intelligence Platform versions 420 et 430
SAP N/A SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50 et CORE-TOOLS 7.50
SAP N/A Vendor Master Hierarchy versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618 et S4CORE 100
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform (Central Management Service) versions 420 et 430
SAP N/A SAP PowerDesigner (Proxy) version 16.7
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP 3D Visual Enterprise License Manager version 15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce versions 2211, 2105 et 2205",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Application Interface Framework (ODATA service) versions 755 et 756",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce (Backoffice) versions 2105 et 2205",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80",
      "product": {
        "name": "SAP CRM WebClient UI",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP GUI pour Windows versions 7.70 et 8.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP IBP EXCEL ADD-IN versions 2211, 2302 et 2305",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Intelligence Platform versions 420 et 430",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50 et CORE-TOOLS 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Vendor Master Hierarchy versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618 et S4CORE 100",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform (Central Management Service) versions 420 et 430",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP PowerDesigner (Proxy) version 16.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-44155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44155"
    },
    {
      "name": "CVE-2023-31407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31407"
    },
    {
      "name": "CVE-2023-30741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30741"
    },
    {
      "name": "CVE-2021-44152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44152"
    },
    {
      "name": "CVE-2022-41966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41966"
    },
    {
      "name": "CVE-2023-29188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29188"
    },
    {
      "name": "CVE-2023-29080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29080"
    },
    {
      "name": "CVE-2022-27667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27667"
    },
    {
      "name": "CVE-2021-44151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44151"
    },
    {
      "name": "CVE-2023-30744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30744"
    },
    {
      "name": "CVE-2022-32244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32244"
    },
    {
      "name": "CVE-2023-30740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30740"
    },
    {
      "name": "CVE-2023-30743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30743"
    },
    {
      "name": "CVE-2021-44153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44153"
    },
    {
      "name": "CVE-2022-39014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39014"
    },
    {
      "name": "CVE-2023-31404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31404"
    },
    {
      "name": "CVE-2023-30742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30742"
    },
    {
      "name": "CVE-2023-32113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32113"
    },
    {
      "name": "CVE-2023-28764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28764"
    },
    {
      "name": "CVE-2023-29111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29111"
    },
    {
      "name": "CVE-2022-31596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31596"
    },
    {
      "name": "CVE-2023-31406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31406"
    },
    {
      "name": "CVE-2023-32112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32112"
    },
    {
      "name": "CVE-2023-32111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32111"
    },
    {
      "name": "CVE-2023-28762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28762"
    },
    {
      "name": "CVE-2021-44154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44154"
    }
  ],
  "initial_release_date": "2023-05-10T00:00:00",
  "last_revision_date": "2023-05-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0369",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-05-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP 2023-05-10 du 10 mai 2023",
      "url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
    }
  ]
}