Refine your search

17 vulnerabilities found for SAP NetWeaver AS Java by SAP

CERTFR-2025-AVI-0867
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
SAP SAP NetWeaver AS Java NetWeaver AS Java version SERVERCORE 7.50 sans le dernier correctif de sécurité
SAP Financial Service Claims Management Financial Service Claims Management versions INSURANCE 803, 804, 805, 806, S4CEXT 107, 108 et 109 sans le dernier correctif de sécurité
SAP Print Service Print Service versions SAPSPRINT 8.00 et 8.10 sans le dernier correctif de sécurité
SAP Data Hub Integration Suite Data Hub Integration Suite version CX_DATAHUB_INT_PACK 2205 sans le dernier correctif de sécurité
SAP BusinessObjects BusinessObjects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité
SAP NetWeaver Application Server pour ABAP Application Server pour ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de sécurité
SAP NetWeaver NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de sécurité
SAP S/4HANA S/4HANA versions S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité
SAP Cloud Appliance Library Appliances Cloud Appliance Library Appliances version TITANIUM_WEBAPP 4.0 sans le dernier correctif de sécurité
SAP Commerce Cloud Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de sécurité
SAP NetWeaver Application Server pour ABAP Application Server pour ABAP versions SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 sans le dernier correctif de sécurité
SAP NetWeaver Application Server ABAP et ABAP Platform NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15 et 9.16 sans le dernier correctif de sécurité
SAP Supplier Relationship Management Supplier Relationship Management versions SRMNXP01 100 et 150 sans le dernier correctif de sécurité
SAP NetWeaver Application Server ABAP NetWeaver Application Server ABAP versions RNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de sécurité
References
Bulletin de sécurité SAP october-2025 2025-10-14 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetWeaver AS Java version SERVERCORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Financial Service Claims Management versions INSURANCE 803, 804, 805, 806, S4CEXT 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Financial Service Claims Management",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Print Service versions SAPSPRINT 8.00 et 8.10 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Print Service",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Data Hub Integration Suite version CX_DATAHUB_INT_PACK 2205 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Data Hub Integration Suite",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BusinessObjects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "BusinessObjects",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Application Server pour ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server pour ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S/4HANA versions S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S/4HANA",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Appliance Library Appliances version TITANIUM_WEBAPP 4.0 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Cloud Appliance Library Appliances",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Application Server pour ABAP versions SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server pour ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Supplier Relationship Management versions SRMNXP01 100 et 150 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Supplier Relationship Management",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server ABAP versions RNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-42944",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42944"
    },
    {
      "name": "CVE-2025-42906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42906"
    },
    {
      "name": "CVE-2025-42902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42902"
    },
    {
      "name": "CVE-2025-42903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42903"
    },
    {
      "name": "CVE-2025-42910",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42910"
    },
    {
      "name": "CVE-2025-42909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42909"
    },
    {
      "name": "CVE-2025-5115",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5115"
    },
    {
      "name": "CVE-2025-42984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42984"
    },
    {
      "name": "CVE-2025-42908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42908"
    },
    {
      "name": "CVE-2025-42937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42937"
    },
    {
      "name": "CVE-2025-0059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0059"
    },
    {
      "name": "CVE-2025-48913",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48913"
    },
    {
      "name": "CVE-2025-42939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42939"
    },
    {
      "name": "CVE-2025-31672",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31672"
    },
    {
      "name": "CVE-2025-31331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31331"
    },
    {
      "name": "CVE-2025-42901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-42901"
    }
  ],
  "initial_release_date": "2025-10-14T00:00:00",
  "last_revision_date": "2025-10-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0867",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2025-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP october-2025",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2025.html"
    }
  ]
}

CERTFR-2024-AVI-0754
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
SAP SAP pour Oil & Gas SAP pour Oil & Gas versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806, 807 et 807 sans le dernier correctif de sécurité
SAP Commerce Cloud Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité
SAP Business Warehouse Business Warehouse (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de sécurité
SAP S/4HANA (Manage Incoming Payment Files) S/4 HANA version 900 sans le dernier correctif de sécurité
SAP NetWeaver BW NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de sécurité
SAP SAP NetWeaver AS Java NetWeaver AS pour Java (Destination Service et Logon Application) version 7.50 sans le dernier correctif de sécurité
SAP SAP BusinessObjects Business Intelligence BusinessObjects Business Intelligence Platform version 430 sans le dernier correctif de sécurité
SAP SAP Student Life Cycle Management Student Life Cycle Management (SLcM) versions 617, 618, 800, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité
SAP SAP BusinessObjects Business Intelligence BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de sécurité
SAP Replication Server Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de sécurité
SAP NetWeaver Application Server ABAP et ABAP Platform SAP NetWeaver Application Server pour ABAP et ABAP Platform, Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 912 sans le dernier correctif de sécurité
SAP Production et Revenue Accounting Production et Revenue Accounting (Tobin interface) versions S4CEXT 106, S4CEXT 107, S4CEXT 108, IS-PRA 605, IS-PRA 606, IS-PRA 616, IS-PRA 617, IS-PRA 618, IS-PRA 800, IS-PRA 801, IS-PRA 802, IS-PRA 803, IS-PRA 804 et IS-PRA 805 sans le dernier correctif de sécurité
SAP NetWeaver Enterprise Portal NetWeaver Enterprise Portal version 7.50 sans le dernier correctif de sécurité
SAP NetWeaver Application Server pour ABAP NetWeaver Application Server pour ABAP (CRM Blueprint Application Builder Panel) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de sécurité
SAP S/4HANA eProcurement S/4HANA eProcurement versions SAP_APPL 606, SAP_APPL 617, SAP_APPL 618, S4CORE 102, S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de sécurité
References
Bulletin de sécurité SAP 2024-09-09 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP pour Oil \u0026 Gas versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806, 807 et 807 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP pour Oil \u0026 Gas",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Warehouse (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Business Warehouse",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S/4 HANA version 900 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S/4HANA (Manage Incoming Payment Files)",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver BW",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver AS pour Java (Destination Service et Logon Application) version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BusinessObjects Business Intelligence Platform version 430 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Student Life Cycle Management (SLcM) versions 617, 618, 800, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP Student Life Cycle Management",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Replication Server",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server pour ABAP et ABAP Platform, Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 912 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Production et Revenue Accounting (Tobin interface) versions S4CEXT 106, S4CEXT 107, S4CEXT 108, IS-PRA 605, IS-PRA 606, IS-PRA 616, IS-PRA 617, IS-PRA 618, IS-PRA 800, IS-PRA 801, IS-PRA 802, IS-PRA 803, IS-PRA 804 et IS-PRA 805 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Production et Revenue Accounting",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Enterprise Portal version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Enterprise Portal",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver Application Server pour ABAP (CRM Blueprint Application Builder Panel) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server pour ABAP",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S/4HANA eProcurement versions SAP_APPL 606, SAP_APPL 617, SAP_APPL 618, S4CORE 102, S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S/4HANA eProcurement",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-45281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45281"
    },
    {
      "name": "CVE-2024-44115",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44115"
    },
    {
      "name": "CVE-2024-45279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45279"
    },
    {
      "name": "CVE-2024-44117",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44117"
    },
    {
      "name": "CVE-2024-33003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-33003"
    },
    {
      "name": "CVE-2023-0215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
    },
    {
      "name": "CVE-2023-0286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
    },
    {
      "name": "CVE-2024-45285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45285"
    },
    {
      "name": "CVE-2024-45286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45286"
    },
    {
      "name": "CVE-2024-44116",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44116"
    },
    {
      "name": "CVE-2024-44113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44113"
    },
    {
      "name": "CVE-2024-41729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41729"
    },
    {
      "name": "CVE-2024-44112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44112"
    },
    {
      "name": "CVE-2024-41728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41728"
    },
    {
      "name": "CVE-2024-42371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42371"
    },
    {
      "name": "CVE-2024-42380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42380"
    },
    {
      "name": "CVE-2024-45280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45280"
    },
    {
      "name": "CVE-2024-45283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45283"
    },
    {
      "name": "CVE-2013-3587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-3587"
    },
    {
      "name": "CVE-2022-0778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
    },
    {
      "name": "CVE-2024-45284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45284"
    },
    {
      "name": "CVE-2024-44114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44114"
    },
    {
      "name": "CVE-2024-41730",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
    },
    {
      "name": "CVE-2024-44121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44121"
    },
    {
      "name": "CVE-2024-42378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42378"
    },
    {
      "name": "CVE-2024-44120",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44120"
    }
  ],
  "initial_release_date": "2024-09-10T00:00:00",
  "last_revision_date": "2024-09-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0754",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2024-09-09",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2024.html"
    }
  ]
}

CERTFR-2024-AVI-0477
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
SAP S/4HANA (Manage Incoming Payment Files) S/4HANA (Manage Incoming Payment Files) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité
SAP SAP Document Builder Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java version GP-CORE 7.5 sans le dernier correctif de sécurité
SAP NetWeaver Application Server ABAP et ABAP Platform SAP NetWeaver Application Server ABAP et ABAP Platform versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de sécurité
SAP Central Finance Infrastructure Components Central Finance Infrastructure Components versions SAP_FIN 720, 730, SAPSCORE 114, S4CORE 100, 101 et 102 sans le dernier correctif de sécurité
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité
SAP NetWeaver Application Server ABAP et ABAP Platform SAP NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de sécurité
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de sécurité
SAP SAP Financial Consolidation Financial Consolidation version FINANCE 1010 sans le dernier correctif de sécurité
SAP SAP BW/4HANA Transformation et Data Transfer Process BW/4HANA Transformation et Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité
SAP SAP Student Life Cycle Management Student Life Cycle Management versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité
SAP SAP CRM WebClient UI CRM WebClient UI versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité
References
Bulletin de sécurité SAP june-2024 2024-06-11 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "S/4HANA (Manage Incoming Payment Files) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "S/4HANA (Manage Incoming Payment Files)",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP Document Builder",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java version GP-CORE 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Central Finance Infrastructure Components versions SAP_FIN 720, 730, SAPSCORE 114, S4CORE 100, 101 et 102 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Central Finance Infrastructure Components",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Financial Consolidation version FINANCE 1010 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP Financial Consolidation",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BW/4HANA Transformation et Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP BW/4HANA Transformation et Data Transfer Process",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Student Life Cycle Management versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP Student Life Cycle Management",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "CRM WebClient UI versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "SAP CRM WebClient UI",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-37176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37176"
    },
    {
      "name": "CVE-2024-34691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34691"
    },
    {
      "name": "CVE-2024-37177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37177"
    },
    {
      "name": "CVE-2024-34686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34686"
    },
    {
      "name": "CVE-2024-34683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
    },
    {
      "name": "CVE-2024-34688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34688"
    },
    {
      "name": "CVE-2024-32733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-32733"
    },
    {
      "name": "CVE-2024-34684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34684"
    },
    {
      "name": "CVE-2024-33001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-33001"
    },
    {
      "name": "CVE-2024-34690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34690"
    },
    {
      "name": "CVE-2024-28164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28164"
    }
  ],
  "initial_release_date": "2024-06-11T00:00:00",
  "last_revision_date": "2024-06-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0477",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2024-06-11",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP june-2024",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2024.html"
    }
  ]
}

CERTFR-2024-AVI-0125
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702
SAP N/A SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731
SAP N/A SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java (Guided Procedures) version 7.50
SAP N/A SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804
SAP N/A SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53
SAP N/A SAP Business Client versions 6.5, 7.0 et 7.70
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java (User Admin Application) version 7.50
SAP N/A SAP Cloud Connector version 2.0
SAP N/A SAP Fiori app ("My Overtime Requests") versions 605
SAP N/A IDES Systems toutes versions
SAP N/A SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I
SAP N/A SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758
SAP N/A BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101
SAP N/A SAP Companion versions antérieures à 3.1.38
SAP SAP CRM WebClient UI SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java (Guided Procedures) version 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client versions 6.5, 7.0 et 7.70",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java (User Admin Application) version 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Cloud Connector version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Fiori app (\"My Overtime Requests\") versions 605",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "IDES Systems toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Companion versions ant\u00e9rieures \u00e0 3.1.38",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
      "product": {
        "name": "SAP CRM WebClient UI",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-24741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24741"
    },
    {
      "name": "CVE-2024-22132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22132"
    },
    {
      "name": "CVE-2024-24739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24739"
    },
    {
      "name": "CVE-2023-49580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49580"
    },
    {
      "name": "CVE-2024-25643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25643"
    },
    {
      "name": "CVE-2024-24742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24742"
    },
    {
      "name": "CVE-2024-25642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25642"
    },
    {
      "name": "CVE-2024-24740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24740"
    },
    {
      "name": "CVE-2024-22129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22129"
    },
    {
      "name": "CVE-2024-22126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22126"
    },
    {
      "name": "CVE-2024-22128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22128"
    },
    {
      "name": "CVE-2024-22131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22131"
    },
    {
      "name": "CVE-2024-22130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22130"
    },
    {
      "name": "CVE-2023-49058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49058"
    },
    {
      "name": "CVE-2024-24743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24743"
    }
  ],
  "initial_release_date": "2024-02-14T00:00:00",
  "last_revision_date": "2024-02-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0125",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SAP. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP february-2024 du 13 f\u00e9vrier 2024",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2024.html"
    }
  ]
}

CERTFR-2023-AVI-0942
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java version 7.5
SAP N/A SAPSSOEXT version 17
SAP N/A SAPExtended Application Services et Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00
SAP N/A SAPHost Agent version 722
SAP N/A Product-SAP IQ version 16.0
SAP N/A SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89
SAP N/A Product-SAP ASE versions 15.7, 16.0
SAP N/A SAP Business One version 10.0
SAP NetWeaver Application Server ABAP et ABAP Platform SAP NetWeaver Application Server ABAP et ABAP Platform versions KERNEL 722, KERNEL 7.53, KERNEL 7.77,KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT
SAP N/A Product-SAP SQL Anywhere versions 16.0, 17.0
SAP N/A SAP CommonCryptoLib version 8
SAP N/A Product-SAP ASE Cluster Edition version 15.7
SAP N/A Product-SAP Event Stream Processor version 5.1
SAP SAP NetWeaver AS Java SAP NetWeaver AS ABAP, SAP NetWeaver AS Java et ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT
SAP N/A SAPHANA Database version 2.0
SAP N/A SAPContent Server versions 6.50, 7.53, 7.54
SAP Replication Server Product-SAP Replication Server version 15.7
SAP N/A NetWeaver AS Java version 7.50
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP NetWeaver AS Java version 7.5",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPSSOEXT version 17",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPExtended Application Services et Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPHost Agent version 722",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Product-SAP IQ version 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Product-SAP ASE versions 15.7, 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business One version 10.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions KERNEL 722, KERNEL 7.53, KERNEL 7.77,KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Product-SAP SQL Anywhere versions 16.0, 17.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CommonCryptoLib version 8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Product-SAP ASE Cluster Edition version 15.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Product-SAP Event Stream Processor version 5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java et ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPHANA Database version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPContent Server versions 6.50, 7.53, 7.54",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Product-SAP Replication Server version 15.7",
      "product": {
        "name": "Replication Server",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "NetWeaver AS Java version 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-40309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40309"
    },
    {
      "name": "CVE-2023-42477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42477"
    },
    {
      "name": "CVE-2023-31403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-31403"
    },
    {
      "name": "CVE-2023-42480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42480"
    },
    {
      "name": "CVE-2023-41366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41366"
    }
  ],
  "initial_release_date": "2023-11-15T00:00:00",
  "last_revision_date": "2023-11-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0942",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-11-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un contournement de la politique de s\u00e9curit\u00e9 et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP ucQrx6G du 14 novembre 2023",
      "url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
    }
  ]
}

CERTFR-2023-AVI-0737
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
SAP N/A SAP Business Objects Business Intelligence Platform (CMC) versions 420 et 430
SAP N/A SAP S/4HANA (Create Single Payment application) versions 100, 101, 102, 103, 104, 105, 106, 107 et 108
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform (versions Management System) versions 430
SAP N/A SAPExtended Application Services and Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00
SAP N/A SAP NetWeaver Process Integration versions 7.50
SAP N/A SAPHANA Database versions 2.0
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430
SAP N/A SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89
SAP N/A S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106 et 107
SAP N/A SAP Business Client versions 6.5, 7.0 et 7.70
SAP N/A SAP NetWeaver AS ABAP (applications based on Unified Rendering) versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702 et SAP_BASIS 731
SAP N/A SAP NetWeaver (Guided Procedures) versions 7.50
SAP N/A SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200
SAP N/A SAPSSOEXT versions 17
SAP N/A Product-SAP BusinessObjects Suite (Installer) versions 420 et 430
SAP N/A SAP Quotation Management Insurance (FS-QUO) versions 400, 510, 700 et 800
SAP N/A SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106
SAP N/A SAPHost Agent versions 722
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) versions 420
SAP N/A SAPContent Server versions 6.50, 7.53, 7.54
SAP N/A SAP PowerDesignerClient versions 16.7
SAP N/A S4 HANA ABAP (Manage checkbook apps) versions 102, 103, 104, 105, 106 et 107
SAP SAP NetWeaver AS Java SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22 et KERNEL64NUC 7.22EXT
References
Bulletin de sécurité SAP 2023-09-12 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Business Objects Business Intelligence Platform (CMC) versions 420 et 430",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP S/4HANA (Create Single Payment application) versions 100, 101, 102, 103, 104, 105, 106, 107 et 108",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform (versions Management System) versions 430",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPExtended Application Services and Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Process Integration versions 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPHANA Database versions 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106 et 107",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client versions 6.5, 7.0 et 7.70",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP (applications based on Unified Rendering) versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702 et SAP_BASIS 731",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (Guided Procedures) versions 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPSSOEXT versions 17",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Product-SAP BusinessObjects Suite (Installer) versions 420 et 430",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Quotation Management Insurance (FS-QUO) versions 400, 510, 700 et 800",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPHost Agent versions 722",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) versions 420",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPContent Server versions 6.50, 7.53, 7.54",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP PowerDesignerClient versions 16.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S4 HANA ABAP (Manage checkbook apps) versions 102, 103, 104, 105, 106 et 107",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22 et KERNEL64NUC 7.22EXT",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-40309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40309"
    },
    {
      "name": "CVE-2023-25616",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25616"
    },
    {
      "name": "CVE-2023-40306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40306"
    },
    {
      "name": "CVE-2021-41182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41182"
    },
    {
      "name": "CVE-2023-41367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41367"
    },
    {
      "name": "CVE-2023-40624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40624"
    },
    {
      "name": "CVE-2023-41369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41369"
    },
    {
      "name": "CVE-2023-40621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40621"
    },
    {
      "name": "CVE-2023-41368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41368"
    },
    {
      "name": "CVE-2022-41272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
    },
    {
      "name": "CVE-2023-37489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37489"
    },
    {
      "name": "CVE-2023-42472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42472"
    },
    {
      "name": "CVE-2021-41184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41184"
    },
    {
      "name": "CVE-2021-41183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41183"
    },
    {
      "name": "CVE-2023-40308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40308"
    },
    {
      "name": "CVE-2023-40622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40622"
    },
    {
      "name": "CVE-2023-40625",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40625"
    },
    {
      "name": "CVE-2023-40623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40623"
    },
    {
      "name": "CVE-2023-24998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
    }
  ],
  "initial_release_date": "2023-09-13T00:00:00",
  "last_revision_date": "2023-09-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0737",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-09-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": "2023-09-12",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP",
      "url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026d=2023-09-13"
    }
  ]
}

CERTFR-2023-AVI-0301
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22,7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82,7.83, KERNEL 7.21, 7.22,7.49, 7.53, 7.73, 7.77, 7.81, 7.82 et 7.83
SAP N/A SAP NetWeaver Process Integration version 7.50
SAP N/A SAP Commerce versions 1905, 2005 et 2011
SAP N/A SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application versions 600 et 700
SAP N/A SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791
SAP N/A SAP Landscape Management version 3.0
SAP N/A SAP Application Interface Framework (ODATA service) versions 755 et 756
SAP N/A SAP NetWeaver AS for ABAP (Business Server Pages) versions 700, 701, 702, 731, 740,750, 751, 752, 753, 754, 755, 756 et 757
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java for Deploy Service version 7.50
SAP N/A SAP Business Client versions 6.5, 7.0 et 7.70
SAP N/A SAP Application Interface Framework (Log Message View of Message Dashboard) versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E
SAP N/A SAP CRM versions 700, 701, 702, 712 et 713
SAP N/A SapSetup (Software Installation Program) version 9.0
SAP N/A SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) version 720
SAP N/A SAP HCM Fiori App My Forms (Fiori 2.0) version 605
SAP NetWeaver Enterprise Portal SAP NetWeaver Enterprise Portal version 7.50
SAP N/A SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800 et 801
SAP N/A SAP NetWeaver (BI CONT ADDON) versions 707, 737, 747 et 757
SAP N/A SAP GUI for HTML versions KERNEL 7.22, 7.53, 7.547.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22 et 7.22EXT
SAP N/A SAP Application Interface Framework (Custom Hint of Message Dashboard Application versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E
SAP N/A SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791
SAP N/A ABAP Platform and SAP Web Dispatcher versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89 et 7.91
SAP N/A SAP Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22,7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82,7.83, KERNEL 7.21, 7.22,7.49, 7.53, 7.73, 7.77, 7.81, 7.82 et 7.83",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Process Integration version 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce versions 1905, 2005 et 2011",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application versions 600 et 700",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Landscape Management version 3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Application Interface Framework (ODATA service) versions 755 et 756",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS for ABAP (Business Server Pages) versions 700, 701, 702, 731, 740,750, 751, 752, 753, 754, 755, 756 et 757",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java for Deploy Service version 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client versions 6.5, 7.0 et 7.70",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Application Interface Framework (Log Message View of Message Dashboard) versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM versions 700, 701, 702, 712 et 713",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SapSetup (Software Installation Program) version 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) version 720",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP HCM Fiori App My Forms (Fiori 2.0) version 605",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Enterprise Portal version 7.50",
      "product": {
        "name": "NetWeaver Enterprise Portal",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800 et 801",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (BI CONT ADDON) versions 707, 737, 747 et 757",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP GUI for HTML versions KERNEL 7.22, 7.53, 7.547.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22 et 7.22EXT",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Application Interface Framework (Custom Hint of Message Dashboard Application versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "ABAP Platform and SAP Web Dispatcher versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89 et 7.91",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-24527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24527"
    },
    {
      "name": "CVE-2023-29185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29185"
    },
    {
      "name": "CVE-2023-29189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29189"
    },
    {
      "name": "CVE-2023-29109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29109"
    },
    {
      "name": "CVE-2020-13936",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
    },
    {
      "name": "CVE-2023-27897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27897"
    },
    {
      "name": "CVE-2023-29187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29187"
    },
    {
      "name": "CVE-2022-41272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
    },
    {
      "name": "CVE-2023-24528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24528"
    },
    {
      "name": "CVE-2023-26458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26458"
    },
    {
      "name": "CVE-2023-29186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29186"
    },
    {
      "name": "CVE-2021-33683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33683"
    },
    {
      "name": "CVE-2023-27267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27267"
    },
    {
      "name": "CVE-2023-28763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28763"
    },
    {
      "name": "CVE-2023-29110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29110"
    },
    {
      "name": "CVE-2023-27499",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27499"
    },
    {
      "name": "CVE-2023-28761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28761"
    },
    {
      "name": "CVE-2023-27269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27269"
    },
    {
      "name": "CVE-2023-27497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27497"
    },
    {
      "name": "CVE-2023-1903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1903"
    },
    {
      "name": "CVE-2023-29111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29111"
    },
    {
      "name": "CVE-2023-29108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29108"
    },
    {
      "name": "CVE-2023-28765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28765"
    },
    {
      "name": "CVE-2023-29112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29112"
    }
  ],
  "initial_release_date": "2023-04-12T00:00:00",
  "last_revision_date": "2023-04-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0301",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-04-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 11 avril 2023",
      "url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
    }
  ]
}

CERTFR-2021-AVI-523
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP Process Integration (Enterprise Service Repository JAVA Mappings) versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50
SAP N/A SAP CRM versions 700, 701, 702, 712, 713, 714
SAP N/A SAP NetWeaver AS ABAP and ABAP Platform versions 700, 702, 730, 731, 804, 740, 750, 784, DEV
SAP N/A SAP 3D Visual Enterprise Viewer version 9.0
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (Enterprise Portal) versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50
SAP N/A SAP NetWeaver AS for Java (Http Service) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
SAP N/A SAP Business Client version 6.5
SAP N/A SAP NetWeaver AS ABAP (Reconciliation Framework) versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F
SAP N/A SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83
SAP N/A SAP Lumira Server version 2.4
SAP N/A SAP NetWeaver Guided Procedures (Administration Workset) versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50
SAP N/A SAP Business Objects Web Intelligence (BI Launchpad) versions 420, 430
SAP N/A SAP NetWeaver AS ABAP and ABAP Platform versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84
SAP N/A SAP NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (Administrator applications) version 7.50
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Process Integration (Enterprise Service Repository JAVA Mappings) versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP CRM versions 700, 701, 702, 712, 713, 714",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP and ABAP Platform versions 700, 702, 730, 731, 804, 740, 750, 784, DEV",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP 3D Visual Enterprise Viewer version 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (Enterprise Portal) versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS for Java (Http Service) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client version 6.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP (Reconciliation Framework) versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Lumira Server version 2.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Guided Procedures (Administration Workset) versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Objects Web Intelligence (BI Launchpad) versions 420, 430",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP and ABAP Platform versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (Administrator applications) version 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-33671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33671"
    },
    {
      "name": "CVE-2021-27610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27610"
    },
    {
      "name": "CVE-2021-33681",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33681"
    },
    {
      "name": "CVE-2021-33678",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33678"
    },
    {
      "name": "CVE-2021-33684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33684"
    },
    {
      "name": "CVE-2021-33677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33677"
    },
    {
      "name": "CVE-2021-33687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33687"
    },
    {
      "name": "CVE-2021-33676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33676"
    },
    {
      "name": "CVE-2021-27604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27604"
    },
    {
      "name": "CVE-2021-33683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33683"
    },
    {
      "name": "CVE-2021-33680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33680"
    },
    {
      "name": "CVE-2021-33689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33689"
    },
    {
      "name": "CVE-2021-33667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33667"
    },
    {
      "name": "CVE-2021-33682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33682"
    },
    {
      "name": "CVE-2021-33670",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33670"
    }
  ],
  "initial_release_date": "2021-07-15T00:00:00",
  "last_revision_date": "2021-07-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-523",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP 580617506 du 13 juillet 2021",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506"
    }
  ]
}

CERTFR-2021-AVI-174
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP NetWeaver Knowledge Management versions 7.01, 7.02, 7.30,7.31, 7.40, 7.50 sans le dernier correctif
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (MigrationService) versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50 sans le dernier correctif
SAP N/A SAP HANA version 2.0 sans le dernier correctif
SAP N/A SAP Manufacturing Integration and Intelligence versions 15.1, 15.2, 15.3, 15.4 sans le dernier correctif
SAP N/A SAP 3D Visual Enterprise Viewer version 9 sans le dernier correctif
SAP N/A SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 731, 7.40, 7.50 sans le dernier correctif
SAP N/A SAP Enterprise Financial Services (Bank Customer Accounts) versions 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800 sans le dernier correctif
SAP N/A SAP Payment Engine version 500 sans le dernier correctif
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP NetWeaver Knowledge Management versions 7.01, 7.02, 7.30,7.31, 7.40, 7.50 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (MigrationService) versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50 sans le dernier correctif",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP HANA version 2.0 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Manufacturing Integration and Intelligence versions 15.1, 15.2, 15.3, 15.4 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP 3D Visual Enterprise Viewer version 9 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 731, 7.40, 7.50 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Enterprise Financial Services (Bank Customer Accounts) versions 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Payment Engine version 500 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-27587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27587"
    },
    {
      "name": "CVE-2021-21487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21487"
    },
    {
      "name": "CVE-2021-27584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27584"
    },
    {
      "name": "CVE-2021-27591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27591"
    },
    {
      "name": "CVE-2021-27589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27589"
    },
    {
      "name": "CVE-2021-21481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21481"
    },
    {
      "name": "CVE-2021-21484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21484"
    },
    {
      "name": "CVE-2021-21480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21480"
    },
    {
      "name": "CVE-2021-27586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27586"
    },
    {
      "name": "CVE-2021-27590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27590"
    },
    {
      "name": "CVE-2021-27588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27588"
    },
    {
      "name": "CVE-2021-21488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21488"
    },
    {
      "name": "CVE-2021-21493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21493"
    },
    {
      "name": "CVE-2021-21486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21486"
    },
    {
      "name": "CVE-2021-21491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21491"
    },
    {
      "name": "CVE-2021-27592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27592"
    },
    {
      "name": "CVE-2021-27585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27585"
    }
  ],
  "initial_release_date": "2021-03-09T00:00:00",
  "last_revision_date": "2021-03-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-174",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-03-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nElles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code arbitraire et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 9 mars 2021",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107"
    }
  ]
}

CERTFR-2021-AVI-017
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP Business Client versions antérieures à 6.5
SAP SAP BusinessObjects Business Intelligence SAP BusinessObjects Business Intelligence platform (Web Intelligence HTML interface) versions antérieures à 410 et 420
SAP Business Warehouse SAP Business Warehouse versions antérieures à 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755 et 782
SAP N/A SAP NetWeaver Master Data Management versions antérieures à 7.10, 7.10.750 et 710
SAP N/A SAP NetWeaver AS ABAP versions antérieures à 740, 750, 751, 752, 753, 754 et 755
SAP N/A SAP BW4HANA versions antérieures à 100 et 200
SAP N/A SAP 3D Visual Enterprise Viewer versions antérieures à 9.0
SAP Commerce Cloud SAP Commerce Cloud versions antérieures à 1808, 1811, 1905, 2005 et 2011
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA versions antérieures à 7.20, 7.30, 7.31, 7.40 et 7.50
SAP N/A SAP EPM ADD-IN versions antérieures à 2.8 et 1010
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (Key Storage Service) versions antérieures à 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40 et 7.50
SAP N/A Automated Note Search Tool (SAP Basis) versions antérieures à 7.0, 7.01,7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 et 7.54
SAP SAP NetWeaver AS Java SAP NetWeaver AS Java (HTTP Service) versions antérieures à 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50
SAP Business Warehouse SAP Business Warehouse versions antérieures à 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755 et 782
SAP Business Warehouse SAP Business Warehouse versions antérieures à 700, 701, 702, 711, 730, 731, 740, 750 et 782
SAP N/A SAP Banking Services (Generic Market Data) versions antérieures à 400, 450 et 500
SAP N/A SAP Master Data Governance versions antérieures à 748, 749, 750, 751, 752, 800, 801, 802, 803 et 804
SAP N/A SAP GUI FOR WINDOWS versions antérieures à 7.60
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Business Client versions ant\u00e9rieures \u00e0 6.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Business Intelligence platform (Web Intelligence HTML interface) versions ant\u00e9rieures \u00e0 410 et 420",
      "product": {
        "name": "SAP BusinessObjects Business Intelligence",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Warehouse versions ant\u00e9rieures \u00e0 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755 et 782",
      "product": {
        "name": "Business Warehouse",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Master Data Management versions ant\u00e9rieures \u00e0 7.10, 7.10.750 et 710",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP versions ant\u00e9rieures \u00e0 740, 750, 751, 752, 753, 754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BW4HANA versions ant\u00e9rieures \u00e0 100 et 200",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP 3D Visual Enterprise Viewer versions ant\u00e9rieures \u00e0 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce Cloud versions ant\u00e9rieures \u00e0 1808, 1811, 1905, 2005 et 2011",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA versions ant\u00e9rieures \u00e0 7.20, 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP EPM ADD-IN versions ant\u00e9rieures \u00e0 2.8 et 1010",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (Key Storage Service) versions ant\u00e9rieures \u00e0 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Automated Note Search Tool (SAP Basis) versions ant\u00e9rieures \u00e0 7.0, 7.01,7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 et 7.54",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS Java (HTTP Service) versions ant\u00e9rieures \u00e0 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Warehouse versions ant\u00e9rieures \u00e0 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755 et 782",
      "product": {
        "name": "Business Warehouse",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Warehouse versions ant\u00e9rieures \u00e0 700, 701, 702, 711, 730, 731, 740, 750 et 782",
      "product": {
        "name": "Business Warehouse",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Banking Services (Generic Market Data) versions ant\u00e9rieures \u00e0 400, 450 et 500",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Master Data Governance versions ant\u00e9rieures \u00e0 748, 749, 750, 751, 752, 800, 801, 802, 803 et 804",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP GUI FOR WINDOWS versions ant\u00e9rieures \u00e0 7.60",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-21446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21446"
    },
    {
      "name": "CVE-2021-21449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21449"
    },
    {
      "name": "CVE-2020-6307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6307"
    },
    {
      "name": "CVE-2021-21467",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21467"
    },
    {
      "name": "CVE-2021-21466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21466"
    },
    {
      "name": "CVE-2020-26816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26816"
    },
    {
      "name": "CVE-2020-26838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26838"
    },
    {
      "name": "CVE-2020-6224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6224"
    },
    {
      "name": "CVE-2021-21451",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21451"
    },
    {
      "name": "CVE-2021-21464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21464"
    },
    {
      "name": "CVE-2021-21468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21468"
    },
    {
      "name": "CVE-2020-6256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6256"
    },
    {
      "name": "CVE-2021-21459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21459"
    },
    {
      "name": "CVE-2021-21462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21462"
    },
    {
      "name": "CVE-2020-26820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26820"
    },
    {
      "name": "CVE-2021-21460",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21460"
    },
    {
      "name": "CVE-2021-21445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21445"
    },
    {
      "name": "CVE-2021-21453",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21453"
    },
    {
      "name": "CVE-2021-21448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21448"
    },
    {
      "name": "CVE-2021-21456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21456"
    },
    {
      "name": "CVE-2021-21450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21450"
    },
    {
      "name": "CVE-2021-21470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21470"
    },
    {
      "name": "CVE-2021-21447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21447"
    },
    {
      "name": "CVE-2021-21465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21465"
    },
    {
      "name": "CVE-2021-21458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21458"
    },
    {
      "name": "CVE-2021-21463",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21463"
    },
    {
      "name": "CVE-2021-21455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21455"
    },
    {
      "name": "CVE-2021-21454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21454"
    },
    {
      "name": "CVE-2021-21461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21461"
    },
    {
      "name": "CVE-2021-21457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21457"
    },
    {
      "name": "CVE-2021-21452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21452"
    },
    {
      "name": "CVE-2021-21469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21469"
    }
  ],
  "initial_release_date": "2021-01-12T00:00:00",
  "last_revision_date": "2021-01-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-017",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-01-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 12 janvier 2021",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476"
    }
  ]
}

CERTFR-2020-AVI-799
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP BusinessObjects BI Platform versions 4.1, 4.2, 4.3
SAP N/A SAP Solution Manager version 7.20
SAP N/A SAP S4 HANA versions 101, 102, 103, 104, 105
SAP N/A SAP NetWeaver AS ABAP versions 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020
SAP Business Warehouse SAP Business Warehouse versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782
SAP N/A SAP Disclosure Management version 10.1
SAP N/A SAP BW4HANA versions 100, 200
SAP N/A SAP NetWeaver AS ABAP versions 740, 750, 751, 752, 753, 754
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
SAP N/A SAP HANA Database version 2.0
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP BusinessObjects BI Platform versions 4.1, 4.2, 4.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Solution Manager version 7.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP S4 HANA versions 101, 102, 103, 104, 105",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP versions 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Warehouse versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782",
      "product": {
        "name": "Business Warehouse",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Disclosure Management version 10.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BW4HANA versions 100, 200",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP versions 740, 750, 751, 752, 753, 754",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP HANA Database version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-26835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26835"
    },
    {
      "name": "CVE-2020-26831",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26831"
    },
    {
      "name": "CVE-2020-26816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26816"
    },
    {
      "name": "CVE-2020-26838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26838"
    },
    {
      "name": "CVE-2020-26832",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26832"
    },
    {
      "name": "CVE-2020-26826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26826"
    },
    {
      "name": "CVE-2020-26837",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26837"
    },
    {
      "name": "CVE-2020-26828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26828"
    },
    {
      "name": "CVE-2020-26830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26830"
    },
    {
      "name": "CVE-2020-26834",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26834"
    },
    {
      "name": "CVE-2020-26829",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26829"
    },
    {
      "name": "CVE-2020-26836",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26836"
    }
  ],
  "initial_release_date": "2020-12-08T00:00:00",
  "last_revision_date": "2020-12-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-799",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-12-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 8 d\u00e9cembre 2020",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079"
    }
  ]
}

CERTFR-2020-AVI-722
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un contournement de la politique de sécurité et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A BANKING SERVICES FROM SAP 9.0(Bank Analyzer) version 500
SAP Commerce Cloud SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905 et 2005
SAP N/A SAP ERP versions 600, 602, 603, 604, 605, 606, 616, 617 et 618
SAP N/A S/4HANA FIN PROD SUBLDGR version 100
SAP N/A SAP S/4 HANA versions 100, 101, 102, 103 et 104
SAP N/A SAP NetWeaver (Knowledge Management) versions 7.30, 7.31, 7.40 et 7.50
SAP N/A SAP AS ABAP(DMIS) versions 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752 et 2020
SAP N/A SAP S4 HANA(DMIS) versions 101, 102, 103, 104 et 105
SAP N/A SAP Data Services version 4.2
SAP N/A SAP Process Integration (PGP Module – Business-to-Business Add On) version 1.0
SAP N/A SAP Solution Manager (JAVA stack) version 7.2
SAP Commerce Cloud SAP Commerce Cloud versions 1808,1811,1905 et 2005
SAP N/A SAP 3D Visual Enterprise Viewer version 9
SAP N/A SAP NetWeaver AS ABAP versions 731, 740, 750, 751, 752, 753, 754, 755 et 782
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA versions 7.20, 7.30, 7.31, 7.40 et 7.50
SAP N/A SAP Solution Manager (User Experience Monitoring) version 7.2
SAP N/A SAP Fiori Launchpad (News Tile Application) versions 750, 751, 752, 753, 754 et 755
SAP N/A SAP ERP Client for E-Bilanz 1.0 version 1.0
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BANKING SERVICES FROM SAP 9.0(Bank Analyzer) version 500",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905 et 2005",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP ERP versions 600, 602, 603, 604, 605, 606, 616, 617 et 618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S/4HANA FIN PROD SUBLDGR version 100",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP S/4 HANA versions 100, 101, 102, 103 et 104",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (Knowledge Management) versions 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP AS ABAP(DMIS) versions 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752 et 2020",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP S4 HANA(DMIS) versions 101, 102, 103, 104 et 105",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Data Services version 4.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Process Integration (PGP Module \u2013 Business-to-Business Add On) version 1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Solution Manager (JAVA stack) version 7.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce Cloud versions 1808,1811,1905 et 2005",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP 3D Visual Enterprise Viewer version 9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP versions 731, 740, 750, 751, 752, 753, 754, 755 et 782",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA versions 7.20, 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Solution Manager (User Experience Monitoring) version 7.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Fiori Launchpad (News Tile Application) versions 750, 751, 752, 753, 754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP ERP Client for E-Bilanz 1.0 version 1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-26807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26807"
    },
    {
      "name": "CVE-2020-26811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26811"
    },
    {
      "name": "CVE-2019-0230",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0230"
    },
    {
      "name": "CVE-2020-6207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6207"
    },
    {
      "name": "CVE-2020-6284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6284"
    },
    {
      "name": "CVE-2020-26823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26823"
    },
    {
      "name": "CVE-2020-26814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26814"
    },
    {
      "name": "CVE-2020-26820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26820"
    },
    {
      "name": "CVE-2020-26821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26821"
    },
    {
      "name": "CVE-2020-26818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26818"
    },
    {
      "name": "CVE-2020-26815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26815"
    },
    {
      "name": "CVE-2020-26817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26817"
    },
    {
      "name": "CVE-2019-0233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0233"
    },
    {
      "name": "CVE-2020-6311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6311"
    },
    {
      "name": "CVE-2020-26824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26824"
    },
    {
      "name": "CVE-2020-26810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26810"
    },
    {
      "name": "CVE-2020-26822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26822"
    },
    {
      "name": "CVE-2020-26819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26819"
    },
    {
      "name": "CVE-2020-6316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6316"
    },
    {
      "name": "CVE-2020-26809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26809"
    },
    {
      "name": "CVE-2020-26808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26808"
    }
  ],
  "initial_release_date": "2020-11-10T00:00:00",
  "last_revision_date": "2020-11-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-722",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-11-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un contournement de la\npolitique de s\u00e9curit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP 562725571 du 10 novembre 2020",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
    }
  ]
}

CERTFR-2020-AVI-549
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAPUI5 (UI_700) version 200
SAP N/A SAP Marketing (Mobile Channel Servlet) versions 130, 140 et 150
SAP N/A SAP Netweaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753 et 754
SAP N/A SAP Adaptive Server Enterprise versions 15.7 et 16.0
SAP N/A SAPFiori (Launchpad) versions 750, 752, 753, 754 et 755
SAP N/A SAP NetWeaver AS ABAP (BSP Test Application) versions 700,701,702,730,731,740,750,751,752,753,754 et 755
SAP N/A S/4HANA FIN PROD SUBLDGR version 100
SAP N/A SAPUI5 (SAP_UI) versions 750, 751, 752, 753, 754 et 755
SAP N/A SAP NetWeaver (Knowledge Management) versions 7.30,7.31,7.40 et 7.50
SAP N/A SAP Business Client version 6.5
SAP N/A SAP 3D Visual Enterprise Viewer version 9
SAP N/A SAP Business Objects Business Intelligence Platform (BI Workspace) versions 4.1 et 4.2
SAP N/A SAPUI5 (UISAPUI5_JAVA) version 7.50
SAP N/A SAP NetWeaver (ABAP Server) et ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754 et 755
SAP N/A SAP NetWeaver (ABAP Server) et ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753 et 755
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50
SAP N/A SAP Solution Manager (User Experience Monitoring) version 7.2
SAP N/A SAP Commerce versions 6.7, 1808, 1811, 1905 et 2005
SAP N/A BANKING SERVICES FROM SAP 9.0 (Bank Analyzer) version 500
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAPUI5 (UI_700) version 200",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Marketing (Mobile Channel Servlet) versions 130, 140 et 150",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Netweaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753 et 754",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Adaptive Server Enterprise versions 15.7 et 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPFiori (Launchpad) versions 750, 752, 753, 754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP (BSP Test Application) versions 700,701,702,730,731,740,750,751,752,753,754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "S/4HANA FIN PROD SUBLDGR version 100",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPUI5 (SAP_UI) versions 750, 751, 752, 753, 754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (Knowledge Management) versions 7.30,7.31,7.40 et 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client version 6.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP 3D Visual Enterprise Viewer version 9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Objects Business Intelligence Platform (BI Workspace) versions 4.1 et 4.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPUI5 (UISAPUI5_JAVA) version 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (ABAP Server) et ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (ABAP Server) et ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Solution Manager (User Experience Monitoring) version 7.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce versions 6.7, 1808, 1811, 1905 et 2005",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "BANKING SERVICES FROM SAP 9.0 (Bank Analyzer) version 500",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-6328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6328"
    },
    {
      "name": "CVE-2020-6282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6282"
    },
    {
      "name": "CVE-2020-6334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6334"
    },
    {
      "name": "CVE-2020-6351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6351"
    },
    {
      "name": "CVE-2020-6296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6296"
    },
    {
      "name": "CVE-2020-6349",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6349"
    },
    {
      "name": "CVE-2020-6359",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6359"
    },
    {
      "name": "CVE-2020-6341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6341"
    },
    {
      "name": "CVE-2020-6338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6338"
    },
    {
      "name": "CVE-2020-6207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6207"
    },
    {
      "name": "CVE-2020-6283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6283"
    },
    {
      "name": "CVE-2020-6343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6343"
    },
    {
      "name": "CVE-2020-6335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6335"
    },
    {
      "name": "CVE-2020-6329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6329"
    },
    {
      "name": "CVE-2020-6344",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6344"
    },
    {
      "name": "CVE-2020-6318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6318"
    },
    {
      "name": "CVE-2020-6347",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6347"
    },
    {
      "name": "CVE-2020-6357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6357"
    },
    {
      "name": "CVE-2020-6346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6346"
    },
    {
      "name": "CVE-2020-6348",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6348"
    },
    {
      "name": "CVE-2020-6312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6312"
    },
    {
      "name": "CVE-2020-6356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6356"
    },
    {
      "name": "CVE-2020-6322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6322"
    },
    {
      "name": "CVE-2020-6325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6325"
    },
    {
      "name": "CVE-2020-6354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6354"
    },
    {
      "name": "CVE-2020-6320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6320"
    },
    {
      "name": "CVE-2020-6288",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6288"
    },
    {
      "name": "CVE-2020-6333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6333"
    },
    {
      "name": "CVE-2020-6332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6332"
    },
    {
      "name": "CVE-2020-6311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6311"
    },
    {
      "name": "CVE-2020-6340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6340"
    },
    {
      "name": "CVE-2020-6317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6317"
    },
    {
      "name": "CVE-2020-6321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6321"
    },
    {
      "name": "CVE-2020-6355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6355"
    },
    {
      "name": "CVE-2020-6352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6352"
    },
    {
      "name": "CVE-2020-6350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6350"
    },
    {
      "name": "CVE-2020-6326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6326"
    },
    {
      "name": "CVE-2020-6337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6337"
    },
    {
      "name": "CVE-2020-6275",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6275"
    },
    {
      "name": "CVE-2020-6302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6302"
    },
    {
      "name": "CVE-2020-11022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
    },
    {
      "name": "CVE-2020-6353",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6353"
    },
    {
      "name": "CVE-2020-6339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6339"
    },
    {
      "name": "CVE-2020-6330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6330"
    },
    {
      "name": "CVE-2020-6314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6314"
    },
    {
      "name": "CVE-2020-6336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6336"
    },
    {
      "name": "CVE-2020-6313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6313"
    },
    {
      "name": "CVE-2020-6358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6358"
    },
    {
      "name": "CVE-2020-6345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6345"
    },
    {
      "name": "CVE-2020-6360",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6360"
    },
    {
      "name": "CVE-2020-6342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6342"
    },
    {
      "name": "CVE-2020-6331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6331"
    },
    {
      "name": "CVE-2020-6324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6324"
    },
    {
      "name": "CVE-2020-6361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6361"
    },
    {
      "name": "CVE-2020-11023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
    },
    {
      "name": "CVE-2020-6327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6327"
    }
  ],
  "initial_release_date": "2020-09-08T00:00:00",
  "last_revision_date": "2020-09-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-549",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-09-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 08 septembre 2020",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700"
    }
  ]
}

CERTFR-2020-AVI-495
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAPUI5 (UI_700) version 200
SAP N/A SAP Business Objects Business Intelligence Platform (Central Management Console) versions 4.2 et 4.3
SAP N/A SAPUI5 (SAP_UI) versions 750, 751, 752, 753, 754 et 755
SAP N/A SAP NetWeaver (Knowledge Management) versions 7.30, 7.31, 7.40 et 7.50
SAP N/A SAP Banking Services (Generic Market Data) versions 400, 450 et 500
SAP N/A SAP S/4 HANA (Fiori UI for General Ledger Accounting) versions 103 et 104
SAP N/A SAP Adaptive Server Enterprise version 16.0
SAP N/A SAP Data Intelligence version 3
SAP N/A SAPUI5 (UISAPUI5_JAVA) version 7.50
SAP N/A SAP NetWeaver (ABAP Server) et ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754 et 755
SAP N/A SAP ERP (HCM Travel Management) versions 600, 602, 603, 604, 605, 606, 607 et 608
SAP N/A SAP Commerce versions 6.7, 1808, 1811, 1905 et 2005
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAPUI5 (UI_700) version 200",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Objects Business Intelligence Platform (Central Management Console) versions 4.2 et 4.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPUI5 (SAP_UI) versions 750, 751, 752, 753, 754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (Knowledge Management) versions 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Banking Services (Generic Market Data) versions 400, 450 et 500",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP S/4 HANA (Fiori UI for General Ledger Accounting) versions 103 et 104",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Adaptive Server Enterprise version 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Data Intelligence version 3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPUI5 (UISAPUI5_JAVA) version 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (ABAP Server) et ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754 et 755",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP ERP (HCM Travel Management) versions 600, 602, 603, 604, 605, 606, 607 et 608",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce versions 6.7, 1808, 1811, 1905 et 2005",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-6293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6293"
    },
    {
      "name": "CVE-2020-6309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6309"
    },
    {
      "name": "CVE-2020-6298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6298"
    },
    {
      "name": "CVE-2020-6296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6296"
    },
    {
      "name": "CVE-2020-6273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6273"
    },
    {
      "name": "CVE-2020-6297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6297"
    },
    {
      "name": "CVE-2020-6300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6300"
    },
    {
      "name": "CVE-2020-6286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6286"
    },
    {
      "name": "CVE-2020-6284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6284"
    },
    {
      "name": "CVE-2019-11358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358"
    },
    {
      "name": "CVE-2020-6299",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6299"
    },
    {
      "name": "CVE-2020-6294",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6294"
    },
    {
      "name": "CVE-2020-6287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6287"
    },
    {
      "name": "CVE-2020-11022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
    },
    {
      "name": "CVE-2020-6310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6310"
    },
    {
      "name": "CVE-2020-6295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6295"
    },
    {
      "name": "CVE-2020-9281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-9281"
    },
    {
      "name": "CVE-2020-6301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6301"
    },
    {
      "name": "CVE-2020-11023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
    }
  ],
  "initial_release_date": "2020-08-11T00:00:00",
  "last_revision_date": "2020-08-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-495",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-08-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 11 ao\u00fbt 2020",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345"
    }
  ]
}

CERTFR-2020-AVI-432
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans SAP . Certaines d'entre elles permettent à un attaquant de provoquer un contournement de la politique de sécurité, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP NetWeaver (XML Toolkit for JAVA) ENGINEAPI versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
SAP N/A SAP Business Objects Business Intelligence Platform (BI Launchpad, bipodata, CMC, Web Intelligence HTML Interface) versions 4.1, 4.2
SAP N/A SAP Business Client version 6.5
SAP N/A SAP Disclosure Management, version 1.0
SAP N/A SAP NetWeaver (ABAP Server) et plate-formes ABAP versions 731, 740, 750
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30, 7.31, 7.40, 7.50
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP NetWeaver (XML Toolkit for JAVA) ENGINEAPI versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Objects Business Intelligence Platform (BI Launchpad, bipodata, CMC, Web Intelligence HTML Interface) versions 4.1, 4.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client version 6.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Disclosure Management, version 1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver (ABAP Server) et plate-formes ABAP versions 731, 740, 750",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-6282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6282"
    },
    {
      "name": "CVE-2020-6280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6280"
    },
    {
      "name": "CVE-2020-6222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6222"
    },
    {
      "name": "CVE-2020-6286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6286"
    },
    {
      "name": "CVE-2020-6276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6276"
    },
    {
      "name": "CVE-2020-6289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6289"
    },
    {
      "name": "CVE-2020-6292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6292"
    },
    {
      "name": "CVE-2020-6281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6281"
    },
    {
      "name": "CVE-2020-6290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6290"
    },
    {
      "name": "CVE-2020-6287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6287"
    },
    {
      "name": "CVE-2020-6285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6285"
    },
    {
      "name": "CVE-2020-6291",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6291"
    },
    {
      "name": "CVE-2020-6278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6278"
    },
    {
      "name": "CVE-2020-6267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6267"
    }
  ],
  "initial_release_date": "2020-07-15T00:00:00",
  "last_revision_date": "2020-07-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-432",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SAP . Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer un contournement de\nla politique de s\u00e9curit\u00e9, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 14 juillet 2020",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675"
    }
  ]
}

CERTFR-2020-AVI-350
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_TABLE) versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753 et 754
SAP N/A SAP Netweaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753 et 754
SAP N/A SAP SuccessFactors Recruiting version 2005
SAP N/A SAP Solution Manager (Problem Context Manager) version 7.2
SAP N/A SAP Liquidity Management for Banking version 6.2
SAP N/A .30, 7.31, 7.40 et 7.50
SAP N/A SAP ERP (Statutory Reporting for Insurance Companies) versions EA-FINSERV 600, 603, 604, 605, 606, 616, 617, 618 et 800; S4CORE 101, 102, 103 et 104
SAP N/A SAP Commerce (Data Hub) versions 6.7, 1808, 1811 et 1905
SAP N/A SAP Fiori pour SAP S/4HANA versions 200, 300, 400 et 500
SAP N/A SAP Business Objects Business Intelligence Platform version 4.2
SAP N/A SAP Gateway versions 7.40 et 2.00
SAP N/A SAP Business One (Backup service) versions 9.3,et 10.0
SAP N/A SAP NetWeaver AS ABAP (Banking Services) versions 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D et 75E
SAP N/A SAP Gateway versions 7.5, 7.51, 7.52 et 7.53
SAP N/A SAP Solution Manager (Trace Analysis) version 7.20
SAP N/A SAP Commerce versions 6.7, 1808, 1811 et 1905
SAP SAP NetWeaver AS Java SAP NetWeaver AS JAVA (P4 Protocol) versions SAP-JEECOR 7.00 et 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20,
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_TABLE) versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753 et 754",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Netweaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753 et 754",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP SuccessFactors Recruiting version 2005",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Solution Manager (Problem Context Manager) version 7.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Liquidity Management for Banking version 6.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": ".30, 7.31, 7.40 et 7.50",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP ERP (Statutory Reporting for Insurance Companies) versions EA-FINSERV 600, 603, 604, 605, 606, 616, 617, 618 et 800; S4CORE 101, 102, 103 et 104",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce (Data Hub) versions 6.7, 1808, 1811 et 1905",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Fiori pour SAP S/4HANA versions 200, 300, 400 et 500",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Objects Business Intelligence Platform version 4.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Gateway versions 7.40 et 2.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business One (Backup service) versions 9.3,et 10.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS ABAP (Banking Services) versions 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D et 75E",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Gateway versions 7.5, 7.51, 7.52 et 7.53",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Solution Manager (Trace Analysis) version 7.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce versions 6.7, 1808, 1811 et 1905",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver AS JAVA (P4 Protocol) versions SAP-JEECOR 7.00 et 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 et 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20,",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-6266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6266"
    },
    {
      "name": "CVE-2020-6246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6246"
    },
    {
      "name": "CVE-2020-6263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6263"
    },
    {
      "name": "CVE-2020-6271",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6271"
    },
    {
      "name": "CVE-2019-17571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
    },
    {
      "name": "CVE-2020-6268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6268"
    },
    {
      "name": "CVE-2019-0319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0319"
    },
    {
      "name": "CVE-2020-6264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6264"
    },
    {
      "name": "CVE-2020-6279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6279"
    },
    {
      "name": "CVE-2020-6269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6269"
    },
    {
      "name": "CVE-2020-6270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6270"
    },
    {
      "name": "CVE-2020-1938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1938"
    },
    {
      "name": "CVE-2020-6239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6239"
    },
    {
      "name": "CVE-2020-6275",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6275"
    },
    {
      "name": "CVE-2020-6260",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6260"
    },
    {
      "name": "CVE-2020-6265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6265"
    },
    {
      "name": "CVE-2018-1000632",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000632"
    }
  ],
  "initial_release_date": "2020-06-09T00:00:00",
  "last_revision_date": "2020-06-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-350",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP 547426775 du 09 juin 2020",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775"
    }
  ]
}

CERTFR-2020-ALE-017
Vulnerability from certfr_alerte

[Mise à jour du 22 juillet 2020]

Le CERT-FR a connaissance de codes d'attaques disponibles publiquement.

Le CERT-FR renouvelle sa recommandation d'appliquer les correctifs de sécurité dans les plus brefs délais.

SAP fournit plus de renseignements à ses clients dans sa note 2934135 (https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html)

[Publication initiale]

De multiples vulnérabilités ont été découvertes dans le composant LM Configuration Wizard de SAP Netweaver AS JAVA. Un attaquant non authentifié peut contourner la politique de sécurité pour exécuter différentes actions d'administration. En particulier, l'attaquant est en mesure de créer un compte avec les droits administrateurs pour se maintenir sur le système.

Solution

L'exposition de Netweaver AS requiert l'application des correctifs sans délai. Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Le CERT-FR recommande également d'appliquer les mesures de sécurisation des applications accessibles en nomadisme [1].

La mise à jour d'un produit ou d'un logiciel est une opération délicate qui doit être menée avec prudence. Il est notamment recommander d'effectuer des tests autant que possible. Des dispositions doivent également être prises pour garantir la continuité de service en cas de difficultés lors de l'application des mises à jour comme des correctifs ou des changements de version.

None
Impacted products
Vendor Product Description
SAP SAP NetWeaver AS Java LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.50
SAP SAP NetWeaver AS Java LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.30
SAP SAP NetWeaver AS Java LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.40
SAP SAP NetWeaver AS Java LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.31
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.50",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.30",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.40",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "LM Configuration Wizard de SAP NetWeaver AS JAVA version 7.31",
      "product": {
        "name": "SAP NetWeaver AS Java",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2020-10-12",
  "content": "## Solution\n\nL\u0027exposition de Netweaver AS requiert l\u0027application des correctifs sans\nd\u00e9lai. Se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention\ndes correctifs (cf. section Documentation).\n\nLe CERT-FR recommande \u00e9galement d\u0027appliquer les mesures de s\u00e9curisation\ndes applications accessibles en nomadisme \\[1\\].\n\n------------------------------------------------------------------------\n\nLa mise \u00e0\u00a0jour d\u0027un produit ou d\u0027un logiciel est une op\u00e9ration d\u00e9licate\nqui doit \u00eatre men\u00e9e avec prudence. Il est notamment recommander\nd\u0027effectuer des tests autant que possible. Des dispositions doivent\n\u00e9galement \u00eatre prises pour garantir la continuit\u00e9 de service en cas de\ndifficult\u00e9s lors de l\u0027application des mises \u00e0 jour comme des correctifs\nou des changements de version.\n",
  "cves": [
    {
      "name": "CVE-2020-6286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6286"
    },
    {
      "name": "CVE-2020-6287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6287"
    }
  ],
  "initial_release_date": "2020-07-15T00:00:00",
  "last_revision_date": "2020-10-12T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 14 juillet 2020",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675"
    },
    {
      "title": "[1] Guide ANSSI sur le nomadisme num\u00e9rique",
      "url": "https://www.ssi.gouv.fr/guide/recommandations-sur-le-nomadisme-numerique/"
    }
  ],
  "reference": "CERTFR-2020-ALE-017",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-07-15T00:00:00.000000"
    },
    {
      "description": "Des codes d\u0027attaques sont disponibles publiquement.",
      "revision_date": "2020-07-22T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. La cl\u00f4ture d\u0027une alerte ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2020-10-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "\u003cstrong\u003e\\[Mise \u00e0 jour du 22 juillet 2020\\]\u003c/strong\u003e\n\nLe CERT-FR a connaissance de codes d\u0027attaques disponibles publiquement.\n\nLe CERT-FR renouvelle sa recommandation d\u0027appliquer les correctifs de\ns\u00e9curit\u00e9 dans les plus brefs d\u00e9lais.\n\nSAP fournit plus de renseignements \u00e0 ses clients dans sa note 2934135\n(\u003chttps://support.sap.com/en/my-support/knowledge-base/security-notes-news.html\u003e)\n\n\u003cstrong\u003e\\[Publication initiale\\]\u003c/strong\u003e\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le composant LM\nConfiguration Wizard de SAP Netweaver AS JAVA. Un attaquant non\nauthentifi\u00e9 peut contourner la politique de s\u00e9curit\u00e9 pour ex\u00e9cuter\ndiff\u00e9rentes actions d\u0027administration. En particulier, l\u0027attaquant est en\nmesure de cr\u00e9er un compte avec les droits administrateurs pour se\nmaintenir sur le syst\u00e8me.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SAP Netweaver AS JAVA",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP du 14 juillet 2020",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin CERT-FR CERTFR-2020-AVI-432 du 15 juillet 2020",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2020-AVI-432/"
    }
  ]
}