Search
Find a vulnerability
Search criteria
214 vulnerabilities by sap
CERTFR-2026-AVI-1300
Vulnerability from certfr_avis - Published: 2026-10-13 - Updated: 2026-10-13
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection SQL (SQLi).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAPUI5 | SAPUI5 (Support Assistant Overlay) version SAP_UI 754 sans le dernier correctif de sécurité | ||
| SAP | Cloud Connector | Cloud Connector version SAP_CLOUD_CONNECTOR 2.0 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server pour ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816 et SAP_BASIS 918 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud (OOTB Code) version COM_CLOUD 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal version EP-ADMIN 7.50 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA (Manage Substitution/Validation Rules) versions S4CORE 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | Manufacturing Integration and Intelligence | Manufacturing Integration and Intelligence versions XMII 15.4 et 15.5 sans le dernier correctif de sécurité | ||
| SAP | SAPUI5 | SAPUI5 versions SAP_UI 750, 754, 755, 756, 757, 758, 816 et UI_700 200 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver ABAP Platform | NetWeaver ABAP Platform versions S4CRM 100, 200, 204, 205, 206, S4CEXT 107, 108, BBPCRM 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA (Linear Asset Management RAP Business Object) version S4CORE 109 sans le dernier correctif de sécurité | ||
| SAP | ABAP Platform | ABAP Platform versions KERNEL 7.93 et 9.16 sans le dernier correctif de sécurité | ||
| SAP | HANA | HANA (Display Product Catalog Based on Customs Declaration) versions GTSCORE 200 et 300 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Visual Composer | NetWeaver Visual Composer version VC70RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP | NetWeaver Application Server ABAP (Applications based on GUI for HTML) versions SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | Manufacturing Integration and Intelligence | Manufacturing Integration and Intelligence (Configuration Service) versions XMII 15.4 et 15.5 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et Web Dispatcher | NetWeaver et Web Dispatcher (Internet Communication Manager) versions HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, CONTSERV 7.53, 7.54, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAPUI5 (Support Assistant Overlay) version SAP_UI 754 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAPUI5",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Cloud Connector version SAP_CLOUD_CONNECTOR 2.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Cloud Connector",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816 et SAP_BASIS 918 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud (OOTB Code) version COM_CLOUD 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal version EP-ADMIN 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Manage Substitution/Validation Rules) versions S4CORE 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Manufacturing Integration and Intelligence versions XMII 15.4 et 15.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Manufacturing Integration and Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, 754, 755, 756, 757, 758, 816 et UI_700 200 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAPUI5",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Platform versions S4CRM 100, 200, 204, 205, 206, S4CEXT 107, 108, BBPCRM 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Linear Asset Management RAP Business Object) version S4CORE 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP Platform versions KERNEL 7.93 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA (Display Product Catalog Based on Customs Declaration) versions GTSCORE 200 et 300 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Visual Composer version VC70RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Visual Composer",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (Applications based on GUI for HTML) versions SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Manufacturing Integration and Intelligence (Configuration Service) versions XMII 15.4 et 15.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Manufacturing Integration and Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et Web Dispatcher (Internet Communication Manager) versions HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, CONTSERV 7.53, 7.54, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et Web Dispatcher",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42938",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42938"
},
{
"name": "CVE-2026-89120",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89120"
},
{
"name": "CVE-2026-89116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89116"
},
{
"name": "CVE-2026-76976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76976"
},
{
"name": "CVE-2026-76975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76975"
},
{
"name": "CVE-2026-89121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89121"
},
{
"name": "CVE-2026-89118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89118"
},
{
"name": "CVE-2026-76972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76972"
},
{
"name": "CVE-2026-89105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89105"
},
{
"name": "CVE-2026-24316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24316"
},
{
"name": "CVE-2026-89107",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89107"
},
{
"name": "CVE-2026-89122",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89122"
},
{
"name": "CVE-2026-89106",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89106"
},
{
"name": "CVE-2026-89111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89111"
},
{
"name": "CVE-2026-89112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89112"
},
{
"name": "CVE-2026-89117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89117"
},
{
"name": "CVE-2026-89110",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89110"
},
{
"name": "CVE-2026-89124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89124"
},
{
"name": "CVE-2026-89108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89108"
},
{
"name": "CVE-2026-58242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58242"
},
{
"name": "CVE-2026-58249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58249"
},
{
"name": "CVE-2026-89113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89113"
}
],
"initial_release_date": "2026-10-13T00:00:00",
"last_revision_date": "2026-10-13T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1300",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection SQL (SQLi).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2026-10-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP october-2026",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html"
}
]
}
CERTFR-2026-AVI-1134
Vulnerability from certfr_avis - Published: 2026-09-08 - Updated: 2026-09-08
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | Extended Passport (EPP) Processing | Extended Passport (EPP) Processing versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, WEBDISP 9.16, 9.18, 9.19, 9.20, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de sécurité | ||
| SAP | Process Integration | Process Integration (SOAP Adapter) versions MESSAGING 7.50 et SAP_XIAF 7.50 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA (Intercompany Matching and Reconciliation) versions SAPSCORE 136, S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | Web Dispatcher, Internet Communication Manager et Content Server | Web Dispatcher, Internet Communication Manager and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.22_EXT, 7.53, 7.54, 7.77, 7.93, 9.16, CONTSERV 7.53, 7.54, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud (Search and Navigation) versions COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA (Finance for Advanced Payment Management) versions S4CORE 105, 106 et 107 sans le dernier correctif de sécurité | ||
| SAP | Integration Suite | Integration Suite versions : Cloud Integration - Trading Partner Management V2 2.9.2 et B2B Integration Factory - Cloud Integration - Trading Partner Management 1.10.0 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud (Search And Navigation) versions COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver Business Client versions BC-WD-CLT-BUS 8.00 et 8.10 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver (GUI for Java) version BC-FES-JAV 8.10 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA (Finance for Advanced Payment Management) versions UIAPFI70 800, 900, 901 et 902 sans le dernier correctif de sécurité | ||
| SAP | SAPUI5 | SAPUI5(Frame Options Allowlist) versions SAP_UI 750, 754, 755, 756, 757, 758, 816 et UI_700 200 sans le dernier correctif de sécurité | ||
| SAP | Manufacturing Integration et Intelligence | Manufacturing Integration et Intelligence versions XMII 15.4 et 15.5 sans le dernier correctif de sécurité | ||
| SAP | ABAP Developer Tools | ABAP Developer Tools versions SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918 et SAP_BASIS 920 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA (Finance for Advanced Payment Management) version S4CORE 108 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server for ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver (Message Server) versions KERNEL 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Extended Passport (EPP) Processing versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, WEBDISP 9.16, 9.18, 9.19, 9.20, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Extended Passport (EPP) Processing",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Process Integration (SOAP Adapter) versions MESSAGING 7.50 et SAP_XIAF 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Process Integration",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Intercompany Matching and Reconciliation) versions SAPSCORE 136, S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher, Internet Communication Manager and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.22_EXT, 7.53, 7.54, 7.77, 7.93, 9.16, CONTSERV 7.53, 7.54, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Web Dispatcher, Internet Communication Manager et Content Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud (Search and Navigation) versions COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Finance for Advanced Payment Management) versions S4CORE 105, 106 et 107 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Integration Suite versions : Cloud Integration - Trading Partner Management V2 2.9.2 et B2B Integration Factory - Cloud Integration - Trading Partner Management 1.10.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Integration Suite",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud (Search And Navigation) versions COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Business Client versions BC-WD-CLT-BUS 8.00 et 8.10 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (GUI for Java) version BC-FES-JAV 8.10 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Finance for Advanced Payment Management) versions UIAPFI70 800, 900, 901 et 902 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5(Frame Options Allowlist) versions SAP_UI 750, 754, 755, 756, 757, 758, 816 et UI_700 200 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAPUI5",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Manufacturing Integration et Intelligence versions XMII 15.4 et 15.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Manufacturing Integration et Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP Developer Tools versions SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918 et SAP_BASIS 920 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "ABAP Developer Tools",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Finance for Advanced Payment Management) version S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Message Server) versions KERNEL 9.16, 9.18, 9.19 et 9.20 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-76958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76958"
},
{
"name": "CVE-2026-76962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76962"
},
{
"name": "CVE-2026-76963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76963"
},
{
"name": "CVE-2026-44756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44756"
},
{
"name": "CVE-2026-76961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76961"
},
{
"name": "CVE-2026-58234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58234"
},
{
"name": "CVE-2026-76960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76960"
},
{
"name": "CVE-2026-76977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76977"
},
{
"name": "CVE-2026-66767",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66767"
},
{
"name": "CVE-2026-58243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58243"
},
{
"name": "CVE-2026-76959",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76959"
},
{
"name": "CVE-2026-58240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58240"
},
{
"name": "CVE-2026-76967",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76967"
},
{
"name": "CVE-2026-66768",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66768"
},
{
"name": "CVE-2026-44766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44766"
},
{
"name": "CVE-2026-76969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76969"
},
{
"name": "CVE-2026-76968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76968"
},
{
"name": "CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"name": "CVE-2026-34477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34477"
},
{
"name": "CVE-2026-76971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76971"
}
],
"initial_release_date": "2026-09-08T00:00:00",
"last_revision_date": "2026-09-08T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1134",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2026-09-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP september-2026",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html"
}
]
}
CERTFR-2026-AVI-0715
Vulnerability from certfr_avis - Published: 2026-06-09 - Updated: 2026-06-09
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une injection SQL (SQLi), une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | BusinessObjects | Business Objects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | N/A | MDG (Review Match Groups Application) versions S4CORE 108, SAP_BASIS 916, SAP_BASIS 917 et SAP_ABA 816 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918 et SAP_BASIS 919 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 722EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18 et 91.9 sans le dernier correctif de sécurité | ||
| SAP | N/A | ODP Data Replication APIs versions DW4CORE 200, 300, 400, PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 750 et 816 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | BusinessObjects | Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver AS Java (JDBC Test Servlet) version BI_UDI 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver Application Server Java (Web Container) version ENGINEAPI 7.50 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud and Data Hub versions HY_COM 2205, HY_DHUB 2205, COM_CLOUD 2211, 2211-JDK21 et DHUB_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori (launchpad) versions SAP_UI 754, 755, 756, 757, 758 et 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | Wily Introscope Enterprise Manager version WILY_INTRO_ENTERPRISE 10.8 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver AS Java versions SERVERCORE 7.50, CORE-TOOLS 7.50 et J2EE-APPS 7.50 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA versions S4FND 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Business Objects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "BusinessObjects",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "MDG (Review Match Groups Application) versions S4CORE 108, SAP_BASIS 916, SAP_BASIS 917 et SAP_ABA 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918 et SAP_BASIS 919 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 722EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18 et 91.9 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ODP Data Replication APIs versions DW4CORE 200, 300, 400, PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 750 et 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "BusinessObjects",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (JDBC Test Servlet) version BI_UDI 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java (Web Container) version ENGINEAPI 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud and Data Hub versions HY_COM 2205, HY_DHUB 2205, COM_CLOUD 2211, 2211-JDK21 et DHUB_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori (launchpad) versions SAP_UI 754, 755, 756, 757, 758 et 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Wily Introscope Enterprise Manager version WILY_INTRO_ENTERPRISE 10.8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java versions SERVERCORE 7.50, CORE-TOOLS 7.50 et J2EE-APPS 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA versions S4FND 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-44746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44746"
},
{
"name": "CVE-2026-44750",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44750"
},
{
"name": "CVE-2026-44743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44743"
},
{
"name": "CVE-2026-44755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44755"
},
{
"name": "CVE-2026-44754",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44754"
},
{
"name": "CVE-2026-29145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
},
{
"name": "CVE-2026-44751",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44751"
},
{
"name": "CVE-2026-44757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44757"
},
{
"name": "CVE-2026-27671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27671"
},
{
"name": "CVE-2026-44744",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44744"
},
{
"name": "CVE-2026-44748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44748"
},
{
"name": "CVE-2025-68161",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
},
{
"name": "CVE-2026-24315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24315"
},
{
"name": "CVE-2026-22732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22732"
},
{
"name": "CVE-2026-40128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40128"
}
],
"initial_release_date": "2026-06-09T00:00:00",
"last_revision_date": "2026-06-09T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0715",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une injection SQL (SQLi), une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 SAP june-2026",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html"
}
]
}
CERTFR-2026-AVI-0256
Vulnerability from certfr_avis - Published: 2026-03-10 - Updated: 2026-03-10
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection SQL (SQLi).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | S/4HANA HCM Portugal and ERP HCM Portugal versions S4HCMCPT 100, 101, 102, SAP_HRCPT 600, 604 et 608 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business One (Job Service) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP | NetWeaver Application Server for ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816 et SAP_BASIS 918 sans le dernier correctif de sécurité | ||
| SAP | N/A | Quotation Management Insurance application (FS-QUO) version FS-QUO 800 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP | NetWeaver Application Server for ABAP versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse (Service API) versions DW4CORE 200, 300, 400, PI_BASIS 2006_1_700, 701, 702, 730, 731, 740, SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP | NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 730, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | Supply Chain Management versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, 109, SCM 700, 701, 702 et 712 sans le dernier correctif de sécurité | ||
| SAP | N/A | Customer Checkout 2.0 version SAP_CUSTOMER_CHECKOUT 2.0 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP | NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP | NetWeaver (Feedback Notification) versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, 75F, 75G, 75H, 75I et 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | Solution Tools Plug-In (ST-PI) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver AS Java (Adobe Document Services) version ADSSAP 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | GUI for Windows with active GuiXT version BC-FES-GUI 8.00 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA HCM Portugal and ERP HCM Portugal versions S4HCMCPT 100, 101, 102, SAP_HRCPT 600, 604 et 608 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One (Job Service) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816 et SAP_BASIS 918 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Quotation Management Insurance application (FS-QUO) version FS-QUO 800 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse (Service API) versions DW4CORE 200, 300, 400, PI_BASIS 2006_1_700, 701, 702, 730, 731, 740, SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 730, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supply Chain Management versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, 109, SCM 700, 701, 702 et 712 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Customer Checkout 2.0 version SAP_CUSTOMER_CHECKOUT 2.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Feedback Notification) versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, 75F, 75G, 75H, 75I et 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Tools Plug-In (ST-PI) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (Adobe Document Services) version ADSSAP 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI for Windows with active GuiXT version BC-FES-GUI 8.00 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-24311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24311"
},
{
"name": "CVE-2026-24313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24313"
},
{
"name": "CVE-2019-17571",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
},
{
"name": "CVE-2026-27685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27685"
},
{
"name": "CVE-2026-24316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24316"
},
{
"name": "CVE-2025-9232",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9232"
},
{
"name": "CVE-2026-27687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27687"
},
{
"name": "CVE-2026-27686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27686"
},
{
"name": "CVE-2026-27684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27684"
},
{
"name": "CVE-2026-24310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24310"
},
{
"name": "CVE-2026-27688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27688"
},
{
"name": "CVE-2026-24309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24309"
},
{
"name": "CVE-2026-27689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27689"
},
{
"name": "CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"name": "CVE-2026-24317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24317"
},
{
"name": "CVE-2026-0489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0489"
}
],
"initial_release_date": "2026-03-10T00:00:00",
"last_revision_date": "2026-03-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0256",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une injection SQL (SQLi).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2026-03-10",
"title": "Bulletin de s\u00e9curit\u00e9 SAP march-2026",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2026.html"
}
]
}
CERTFR-2026-AVI-0141
Vulnerability from certfr_avis - Published: 2026-02-10 - Updated: 2026-02-10
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA | S/4HANA Defense & Security (Disconnected Operations) versions EA-DFPS 600, 603, 604, 605, 606, 616, 617, 618, 619, 800, 801, 802, 803, 804, 805, 806, 807, 808 et 809 sans le dernier correctif de sécurité | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform (AdminTools) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects BI Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | N/A | Support Tools Plug-In versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver (JMS service) version J2EE-FRMW 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | ABAP based systems versions ST-PI 2005_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Document Management System versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 804, SAP_BASIS 916, SAP_BASIS 917 et SAP_BASIS 918 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | CRM et S/4HANA (Scripting Editor) versions S4FND 102, 103, 104, 105, 106, 107, 108, 109, SAP_ABA 700, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité | ||
| SAP | Business One (SLD) | Business One (B1 Client Memory Dump Files) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | Supply Chain Management versions SCMAPO 713, 714, SCM 700, 701, 702 et 712 sans le dernier correctif de sécurité | ||
| SAP | Fiori App | Fiori App (Manage Service Entry Sheets - Lean Services) versions S4CORE 102, 103, 104, 105, 106 et 107 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Workflow versions SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver Application Server ABAP and S/4HANA versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Server Pages Application (TAF_APPLAUNCHER) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver and ABAP Platform (Application Server ABAP) versions [KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.17 et 9.18] sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et COM_CLOUD 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18 et 9.19 sans le dernier correctif de sécurité | ||
| SAP | N/A | Solution Tools Plug-In (ST-PI) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Enterprise (Central Management Console) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | N/A | Strategic Enterprise Management (Balanced Scorecard in BSP Application) versions SEM-BW 600, 700, 602, 603, 604, 605, 634, 736, 746, 747, 748 et 800 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver Application Server Java version LMNWABASICAPPS 7.50 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA Defense \u0026 Security (Disconnected Operations) versions EA-DFPS 600, 603, 604, 605, 606, 616, 617, 618, 619, 800, 801, 802, 803, 804, 805, 806, 807, 808 et 809 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (AdminTools) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects BI Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Support Tools Plug-In versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (JMS service) version J2EE-FRMW 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP based systems versions ST-PI 2005_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Management System versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 804, SAP_BASIS 916, SAP_BASIS 917 et SAP_BASIS 918 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM et S/4HANA (Scripting Editor) versions S4FND 102, 103, 104, 105, 106, 107, 108, 109, SAP_ABA 700, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One (B1 Client Memory Dump Files) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business One (SLD)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supply Chain Management versions SCMAPO 713, 714, SCM 700, 701, 702 et 712 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (Manage Service Entry Sheets - Lean Services) versions S4CORE 102, 103, 104, 105, 106 et 107 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Fiori App",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Workflow versions SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and S/4HANA versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Server Pages Application (TAF_APPLAUNCHER) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver and ABAP Platform (Application Server ABAP) versions [KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.17 et 9.18] sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et COM_CLOUD 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18 et 9.19 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Tools Plug-In (ST-PI) versions ST-PI 2008_1_700, 2008_1_710, 740 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Enterprise (Central Management Console) versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Strategic Enterprise Management (Balanced Scorecard in BSP Application) versions SEM-BW 600, 700, 602, 603, 604, 605, 634, 736, 746, 747, 748 et 800 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version LMNWABASICAPPS 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-23681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23681"
},
{
"name": "CVE-2026-24326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24326"
},
{
"name": "CVE-2026-24320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24320"
},
{
"name": "CVE-2026-23688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23688"
},
{
"name": "CVE-2026-24319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24319"
},
{
"name": "CVE-2026-24321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24321"
},
{
"name": "CVE-2026-0485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0485"
},
{
"name": "CVE-2026-24324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24324"
},
{
"name": "CVE-2026-0509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0509"
},
{
"name": "CVE-2026-0508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0508"
},
{
"name": "CVE-2025-12383",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12383"
},
{
"name": "CVE-2026-24312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24312"
},
{
"name": "CVE-2026-0486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0486"
},
{
"name": "CVE-2026-23684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23684"
},
{
"name": "CVE-2025-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0059"
},
{
"name": "CVE-2026-23689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23689"
},
{
"name": "CVE-2026-0484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0484"
},
{
"name": "CVE-2026-24325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24325"
},
{
"name": "CVE-2026-0488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0488"
},
{
"name": "CVE-2026-0490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0490"
},
{
"name": "CVE-2026-23687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23687"
},
{
"name": "CVE-2026-24322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24322"
},
{
"name": "CVE-2026-23686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23686"
},
{
"name": "CVE-2026-23685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23685"
},
{
"name": "CVE-2026-24323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24323"
},
{
"name": "CVE-2026-0505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0505"
},
{
"name": "CVE-2026-24328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24328"
},
{
"name": "CVE-2026-24327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24327"
}
],
"initial_release_date": "2026-02-10T00:00:00",
"last_revision_date": "2026-02-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0141",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2026-02-10",
"title": "Bulletin de s\u00e9curit\u00e9 SAP february-2026",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2026.html"
}
]
}
CERTFR-2026-AVI-0034
Vulnerability from certfr_avis - Published: 2026-01-14 - Updated: 2026-01-14
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Landscape Transformation versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752 et 2020 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | ERP Central Component and S/4HANA | ERP Central Component and S/4HANA (EHS Management) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 605, 606 et 617 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | HANA database version HDB 2.00 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | Fiori App | Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA (Private Cloud and On-Premise) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | Business Server Pages Application | Business Server Pages Application (Product Designer Web UI) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de sécurité | ||
| SAP | Business Connector | Business Connector version SAP BC 4.8 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Business Server Pages Application (Product Designer Web UI) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | NW AS Java UME User Mapping versions ENGINEAPI 7.50, SERVERCORE 7.50 et UMEADMIN 7.50 sans le dernier correctif de sécurité | ||
| SAP | Supplier Relationship Management | Supplier Relationship Management (SICF Handler in SRM Catalog) versions SRM_SERVER 700, 701, 702, 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Application Server for ABAP and NetWeaver RFCSDK versions KRNL64UC 7.53, NWRFCSDK 7.50, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | S/4HANA Private Cloud and On-Premise (Financials General Ledger) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA Private Cloud and On-Premise | S/4HANA Private Cloud and On-Premise (Financials General Ledger) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | S/4HANA (Private Cloud and On-Premise) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | Fiori App | Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107, 108, 109 et UIS4H 109 sans le dernier correctif de sécurité | ||
| SAP | Wily Introscope Enterprise Manager | Wily Introscope Enterprise Manager (WorkStation) version WILY_INTRO_ENTERPRISE 10.8 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | ERP Central Component and S/4HANA (EHS Management) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 605, 606 et 617 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NW AS Java UME User Mapping versions ENGINEAPI 7.50, SERVERCORE 7.50 et UMEADMIN 7.50 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Supplier Relationship Management (SICF Handler in SRM Catalog) versions SRM_SERVER 700, 701, 702, 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Identity Management versions IDM_CLM_REST_API 8.0 et IDMIC 8.0 sans le dernier correctif de sécurité | ||
| SAP | Identity Management | Identity Management versions IDM_CLM_REST_API 8.0 et IDMIC 8.0 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Wily Introscope Enterprise Manager (WorkStation) version WILY_INTRO_ENTERPRISE 10.8 sans le dernier correctif de sécurité | ||
| SAP | HANA database | HANA database version HDB 2.00 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107, 108, 109 et UIS4H 109 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902 et UIS4H 109 sans le dernier correctif de sécurité | ||
| SAP | Fiori App | Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902 et UIS4H 109 sans le dernier correctif de sécurité | ||
| SAP | Application Server for ABAP and NetWeaver RFCSDK | Business Connector version SAP BC 4.8 sans le dernier correctif de sécurité | ||
| SAP | Landscape Transformation | Landscape Transformation versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752 et 2020 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Landscape Transformation versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752 et 2020 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ERP Central Component and S/4HANA (EHS Management) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 605, 606 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "ERP Central Component and S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA database version HDB 2.00 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Fiori App",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud and On-Premise) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Server Pages Application (Product Designer Web UI) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business Server Pages Application",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Connector version SAP BC 4.8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business Connector",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Server Pages Application (Product Designer Web UI) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 600, 602, 603, 604, 605, 606 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NW AS Java UME User Mapping versions ENGINEAPI 7.50, SERVERCORE 7.50 et UMEADMIN 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (SICF Handler in SRM Catalog) versions SRM_SERVER 700, 701, 702, 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Supplier Relationship Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Application Server for ABAP and NetWeaver RFCSDK versions KRNL64UC 7.53, NWRFCSDK 7.50, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Private Cloud and On-Premise (Financials General Ledger) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Private Cloud and On-Premise (Financials General Ledger) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA Private Cloud and On-Premise",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud and On-Premise) versions S4CORE 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107, 108, 109 et UIS4H 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Fiori App",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Wily Introscope Enterprise Manager (WorkStation) version WILY_INTRO_ENTERPRISE 10.8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Wily Introscope Enterprise Manager",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ERP Central Component and S/4HANA (EHS Management) versions SAP_APPL 618, S4CORE 102, 103, 104, 105, 106, 107, 108, 109, EA-APPL 605, 606 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NW AS Java UME User Mapping versions ENGINEAPI 7.50, SERVERCORE 7.50 et UMEADMIN 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (SICF Handler in SRM Catalog) versions SRM_SERVER 700, 701, 702, 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Identity Management versions IDM_CLM_REST_API 8.0 et IDMIC 8.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Identity Management versions IDM_CLM_REST_API 8.0 et IDMIC 8.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Identity Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Wily Introscope Enterprise Manager (WorkStation) version WILY_INTRO_ENTERPRISE 10.8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA database version HDB 2.00 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "HANA database",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902, S4CORE 102, 103, 104, 105, 106, 107, 108, 109 et UIS4H 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902 et UIS4H 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (Intercompany Balance Reconciliation) versions UIAPFI70 500, 600, 700, 800, 900, 901, 902 et UIS4H 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Fiori App",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Connector version SAP BC 4.8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server for ABAP and NetWeaver RFCSDK",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752 et 2020 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Landscape Transformation",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-0507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0507"
},
{
"name": "CVE-2026-0506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0506"
},
{
"name": "CVE-2026-0510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0510"
},
{
"name": "CVE-2026-0500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0500"
},
{
"name": "CVE-2026-0503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0503"
},
{
"name": "CVE-2026-0492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0492"
},
{
"name": "CVE-2026-0498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0498"
},
{
"name": "CVE-2026-0493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0493"
},
{
"name": "CVE-2026-0514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0514"
},
{
"name": "CVE-2026-0501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0501"
},
{
"name": "CVE-2026-0494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0494"
},
{
"name": "CVE-2026-0497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0497"
},
{
"name": "CVE-2026-0513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0513"
},
{
"name": "CVE-2026-0495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0495"
},
{
"name": "CVE-2026-0496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0496"
},
{
"name": "CVE-2026-0491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0491"
},
{
"name": "CVE-2026-0504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0504"
},
{
"name": "CVE-2026-0499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0499"
},
{
"name": "CVE-2026-0511",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0511"
}
],
"initial_release_date": "2026-01-14T00:00:00",
"last_revision_date": "2026-01-14T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0034",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Injection SQL (SQLi)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2026-01-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP january-2026",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2026.html"
}
]
}
CERTFR-2025-AVI-1079
Vulnerability from certfr_avis - Published: 2025-12-09 - Updated: 2025-12-09
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAPUI5 framework | SAPUI5 framework (Markdown-it component) versions SAP_UI 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | BusinessObjects | Business Objects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver Internet Communication Framework versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | Web Dispatcher, Internet Communication Manager et Content Server | Web Dispatcher, Internet Communication Manager et Content Server versions KRNL64UC 7.53, WEBDISP 7.53, 7.54, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, CONTSERV 7.53, 7.54, KERNEL 7.53 et 7.54 sans le dernier correctif de sécurité | ||
| SAP | jConnect | jConnect - SDK for ASE versions SYBASE_SOFTWARE_DEVELOPER_KIT 16.0.4 et 16.1 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | Enterprise Search pour ABAP | Enterprise Search pour ABAP versions SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | Web Dispatcher et Internet Communication Manager (ICM) | Web Dispatcher et Internet Communication Manager (ICM) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.22_EXT, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4 HANA Private Cloud (Financials General Ledger) versions S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver (remote service for Xcelsius) versions BI-BASE-E 7.50, BI-BASE-B 7.50, BI-IBC 7.50, BI-BASE-S 7.50 et BIWEBAPP 7.50 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et COM_CLOUD 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | Business Objects Business Intelligence Platform | Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | Solution Manager | Solution Manager version ST 720 sans le dernier correctif de sécurité | ||
| SAP | Application Server ABAP | Application Server ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.16 et 9.17 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAPUI5 framework (Markdown-it component) versions SAP_UI 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAPUI5 framework",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "BusinessObjects",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Internet Communication Framework versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher, Internet Communication Manager et Content Server versions KRNL64UC 7.53, WEBDISP 7.53, 7.54, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, CONTSERV 7.53, 7.54, KERNEL 7.53 et 7.54 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Web Dispatcher, Internet Communication Manager et Content Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "jConnect - SDK for ASE versions SYBASE_SOFTWARE_DEVELOPER_KIT 16.0.4 et 16.1 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "jConnect",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enterprise Search pour ABAP versions SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Enterprise Search pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher et Internet Communication Manager (ICM) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.22_EXT, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Web Dispatcher et Internet Communication Manager (ICM)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA Private Cloud (Financials General Ledger) versions S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (remote service for Xcelsius) versions BI-BASE-E 7.50, BI-BASE-B 7.50, BI-IBC 7.50, BI-BASE-S 7.50 et BIWEBAPP 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et COM_CLOUD 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Manager version ST 720 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Solution Manager",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Application Server ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.16 et 9.17 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42875",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42875"
},
{
"name": "CVE-2025-55752",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55752"
},
{
"name": "CVE-2025-42904",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42904"
},
{
"name": "CVE-2025-42891",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42891"
},
{
"name": "CVE-2025-42877",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42877"
},
{
"name": "CVE-2025-42880",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42880"
},
{
"name": "CVE-2025-55754",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55754"
},
{
"name": "CVE-2025-42874",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42874"
},
{
"name": "CVE-2025-48976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
},
{
"name": "CVE-2025-42873",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42873"
},
{
"name": "CVE-2025-42878",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42878"
},
{
"name": "CVE-2025-42876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42876"
},
{
"name": "CVE-2025-42872",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42872"
},
{
"name": "CVE-2025-42928",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42928"
},
{
"name": "CVE-2025-42896",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42896"
}
],
"initial_release_date": "2025-12-09T00:00:00",
"last_revision_date": "2025-12-09T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1079",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-12-09",
"title": "Bulletin de s\u00e9curit\u00e9 SAP december-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html"
}
]
}
CERTFR-2025-AVI-0867
Vulnerability from certfr_avis - Published: 2025-10-14 - Updated: 2025-10-14
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAP NetWeaver AS Java | NetWeaver AS Java version SERVERCORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | Financial Service Claims Management | Financial Service Claims Management versions INSURANCE 803, 804, 805, 806, S4CEXT 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | Print Service | Print Service versions SAPSPRINT 8.00 et 8.10 sans le dernier correctif de sécurité | ||
| SAP | Data Hub Integration Suite | Data Hub Integration Suite version CX_DATAHUB_INT_PACK 2205 sans le dernier correctif de sécurité | ||
| SAP | BusinessObjects | BusinessObjects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | Application Server pour ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver | NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de sécurité | ||
| SAP | S/4HANA | S/4HANA versions S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité | ||
| SAP | Cloud Appliance Library Appliances | Cloud Appliance Library Appliances version TITANIUM_WEBAPP 4.0 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | Application Server pour ABAP versions SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15 et 9.16 sans le dernier correctif de sécurité | ||
| SAP | Supplier Relationship Management | Supplier Relationship Management versions SRMNXP01 100 et 150 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP | NetWeaver Application Server ABAP versions RNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver AS Java version SERVERCORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Financial Service Claims Management versions INSURANCE 803, 804, 805, 806, S4CEXT 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Financial Service Claims Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Print Service versions SAPSPRINT 8.00 et 8.10 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Print Service",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Hub Integration Suite version CX_DATAHUB_INT_PACK 2205 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Data Hub Integration Suite",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "BusinessObjects",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Application Server pour ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA versions S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Cloud Appliance Library Appliances version TITANIUM_WEBAPP 4.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Cloud Appliance Library Appliances",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Application Server pour ABAP versions SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15 et 9.16 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management versions SRMNXP01 100 et 150 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Supplier Relationship Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions RNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42944",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42944"
},
{
"name": "CVE-2025-42906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42906"
},
{
"name": "CVE-2025-42902",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42902"
},
{
"name": "CVE-2025-42903",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42903"
},
{
"name": "CVE-2025-42910",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42910"
},
{
"name": "CVE-2025-42909",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42909"
},
{
"name": "CVE-2025-5115",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5115"
},
{
"name": "CVE-2025-42984",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42984"
},
{
"name": "CVE-2025-42908",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42908"
},
{
"name": "CVE-2025-42937",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42937"
},
{
"name": "CVE-2025-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0059"
},
{
"name": "CVE-2025-48913",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48913"
},
{
"name": "CVE-2025-42939",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42939"
},
{
"name": "CVE-2025-31672",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31672"
},
{
"name": "CVE-2025-31331",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31331"
},
{
"name": "CVE-2025-42901",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42901"
}
],
"initial_release_date": "2025-10-14T00:00:00",
"last_revision_date": "2025-10-14T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0867",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-10-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 SAP october-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2025.html"
}
]
}
CERTFR-2025-AVI-0674
Vulnerability from certfr_avis - Published: 2025-08-12 - Updated: 2025-08-12
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | Landscape Transformation | Landscape Transformation (Analysis Platform) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 | ||
| SAP | S/4HANA | S/4HANA (Bank Communication Management) Versions SAP_APPL 606, SAP_FIN 617, 618, 720, 730, S4CORE 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server pour ABAP versions KRNL64UC 7.53, KERNEL versions 7.53, 7.54, 7.77, 7.89 et 7.93 | ||
| SAP | Business One (SLD) | Business One (SLD) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver ABAP Platform versions S4CRM 100, 200, 204, 205, 206, S4CEXT 107, 108, 109, BBPCRM 713 et 714 | ||
| SAP | S/4HANA | S/4HANA avec le composant S4CORE versions 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | Cloud Connector | Cloud Connector version SAP_CLOUD_CONNECTOR 2.0 | ||
| SAP | SAP GUI pour Windows | SAP GUI pour Windows version BC-FES-GUI 8.00 | ||
| SAP | NetWeaver ABAP Platform | NetWeaver ABAP Platform versions SAP_BASIS 758, SAP_BASIS 816 et SAP_BASIS 916 | ||
| SAP | Fiori | Fiori (Launchpad) version SAP_UI 754 | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server pour ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 914 et SAP_BASIS 916 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server ABAP et ABAP Platform (Internet Communication Manager) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15 et 9.16 | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server pour ABAP (BIC Document) versions S4COREOP 104, 105, 106, 107, 108, SEM-BW 600, 602, 603, 604, 605, 634, 736, 746, 747 et 748 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Landscape Transformation (Analysis Platform) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020",
"product": {
"name": "Landscape Transformation",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Bank Communication Management) Versions SAP_APPL 606, SAP_FIN 617, 618, 720, 730, S4CORE 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP versions KRNL64UC 7.53, KERNEL versions 7.53, 7.54, 7.77, 7.89 et 7.93",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One (SLD) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0",
"product": {
"name": "Business One (SLD)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Platform versions S4CRM 100, 200, 204, 205, 206, S4CEXT 107, 108, 109, BBPCRM 713 et 714",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA avec le composant S4CORE versions 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Cloud Connector version SAP_CLOUD_CONNECTOR 2.0",
"product": {
"name": "Cloud Connector",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI pour Windows version BC-FES-GUI 8.00",
"product": {
"name": "SAP GUI pour Windows",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Platform versions SAP_BASIS 758, SAP_BASIS 816 et SAP_BASIS 916",
"product": {
"name": "NetWeaver ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori (Launchpad) version SAP_UI 754",
"product": {
"name": "Fiori",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 914 et SAP_BASIS 916",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP et ABAP Platform (Internet Communication Manager) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15 et 9.16",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP (BIC Document) versions S4COREOP 104, 105, 106, 107, 108, SEM-BW 600, 602, 603, 604, 605, 634, 736, 746, 747 et 748",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42943",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42943"
},
{
"name": "CVE-2025-42975",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42975"
},
{
"name": "CVE-2025-42945",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42945"
},
{
"name": "CVE-2025-42950",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42950"
},
{
"name": "CVE-2025-42936",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42936"
},
{
"name": "CVE-2025-42949",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42949"
},
{
"name": "CVE-2025-42946",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42946"
},
{
"name": "CVE-2025-42934",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42934"
},
{
"name": "CVE-2025-42955",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42955"
},
{
"name": "CVE-2025-42935",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42935"
},
{
"name": "CVE-2025-42948",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42948"
},
{
"name": "CVE-2025-42976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42976"
},
{
"name": "CVE-2025-42957",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42957"
},
{
"name": "CVE-2025-42951",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42951"
},
{
"name": "CVE-2025-42941",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42941"
},
{
"name": "CVE-2025-42942",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42942"
}
],
"initial_release_date": "2025-08-12T00:00:00",
"last_revision_date": "2025-08-12T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0674",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-08-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 SAP august-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html"
}
]
}
CERTFR-2025-AVI-0564
Vulnerability from certfr_avis - Published: 2025-07-08 - Updated: 2025-07-08
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver | NetWeaver et ABAP Platform (SDCCN) versions ST-PI 2008_1_700, 2008_1_710 et 740 | ||
| SAP | NetWeaver | NetWeaver Application Server ABAP and ABAP Platform versionsAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027 | ||
| SAP | NetWeaver | NetWeaver Application Server Java version ENGINEAPI 7.50 | ||
| SAP | NetWeaver | NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | Business Warehouse | Business Warehouse and SAP BW/4HANA BEx Tools version DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | NetWeaver | NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50 | ||
| SAP | Business Objects Business Intelligence Platform | Business Objects Business Intelligence Platform (CMC) versions ENTERPRISE 430 et 2025 | ||
| SAP | NetWeaver | NetWeaver Enterprise Portal Federated Portal Network version EP-RUNTIME 7.50 | ||
| SAP | NetWeaver | NetWeaver (RFC enabled function module) versions SAP_BW 700, 701, 702, 710, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et 916 | ||
| SAP | NetWeaver | NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA and SAP SCM (Characteristic Propagation) versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, SCM 700, 701, 702 et 712 | ||
| SAP | N/A | SAPCAR versions SAP_CAR 7.53 et 7.22EXT | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758 | ||
| SAP | NetWeaver | NetWeaver ABAP Server and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914 et SAP_BASIS 915 | ||
| SAP | NetWeaver | NetWeaver et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753 et SAP_BASIS 754 | ||
| SAP | NetWeaver | NetWeaver Application Server for Java (Log Viewer) version LMNWABASICAPPS 7.50 | ||
| SAP | NetWeaver | NetWeaver (XML Data Archiving Service) version J2EE-APPS 7.50 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Content Administrator workbench versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | N/A | Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | N/A | Data Services (DQ Report) versions SBOP_DS_MANAGEMENT_CONSOLE 4.3 et 2025 | ||
| SAP | NetWeaver | NetWeaver Visual Composer version VCBASE 7.50 | ||
| SAP | NetWeaver | NetWeaver Business Warehouse (CCAW application) versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | N/A | Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14 | ||
| SAP | Business Warehouse | Business Warehouse (Business Explorer Web 3.5 loading animation) versions DW4CORE 100, 200, 300, 400, 916, SAP_BW 730, 731, 740, 750, 751, 752, 753, 754, 756, 757 et 758 | ||
| SAP | NetWeaver | NetWeaver Application Server for ABAP versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects BI Platform Central Management Console Promotion Management Application versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | Business Warehouse | Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver et ABAP Platform (SDCCN) versions ST-PI 2008_1_700, 2008_1_710 et 740",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versionsAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version ENGINEAPI 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse and SAP BW/4HANA BEx Tools version DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (CMC) versions ENTERPRISE 430 et 2025",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal Federated Portal Network version EP-RUNTIME 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (RFC enabled function module) versions SAP_BW 700, 701, 702, 710, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et 916",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA and SAP SCM (Characteristic Propagation) versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, SCM 700, 701, 702 et 712",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPCAR versions SAP_CAR 7.53 et 7.22EXT",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Server and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914 et SAP_BASIS 915",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753 et SAP_BASIS 754",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for Java (Log Viewer) version LMNWABASICAPPS 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (XML Data Archiving Service) version J2EE-APPS 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Content Administrator workbench versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Services (DQ Report) versions SBOP_DS_MANAGEMENT_CONSOLE 4.3 et 2025",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Visual Composer version VCBASE 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Business Warehouse (CCAW application) versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse (Business Explorer Web 3.5 loading animation) versions DW4CORE 100, 200, 300, 400, 916, SAP_BW 730, 731, 740, 750, 751, 752, 753, 754, 756, 757 et 758",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects BI Platform Central Management Console Promotion Management Application versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42985"
},
{
"name": "CVE-2025-42968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42968"
},
{
"name": "CVE-2025-42971",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42971"
},
{
"name": "CVE-2025-42954",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42954"
},
{
"name": "CVE-2025-42970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42970"
},
{
"name": "CVE-2025-42953",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42953"
},
{
"name": "CVE-2025-31326",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31326"
},
{
"name": "CVE-2025-42961",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42961"
},
{
"name": "CVE-2025-42974",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42974"
},
{
"name": "CVE-2025-42978",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42978"
},
{
"name": "CVE-2025-30012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30012"
},
{
"name": "CVE-2025-42952",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42952"
},
{
"name": "CVE-2025-42981",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42981"
},
{
"name": "CVE-2025-42979",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42979"
},
{
"name": "CVE-2025-42993",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42993"
},
{
"name": "CVE-2025-42959",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42959"
},
{
"name": "CVE-2025-42963",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42963"
},
{
"name": "CVE-2025-42969",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42969"
},
{
"name": "CVE-2025-42977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42977"
},
{
"name": "CVE-2025-42986",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42986"
},
{
"name": "CVE-2025-42966",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42966"
},
{
"name": "CVE-2025-30009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30009"
},
{
"name": "CVE-2025-30011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30011"
},
{
"name": "CVE-2025-42962",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42962"
},
{
"name": "CVE-2025-42956",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42956"
},
{
"name": "CVE-2025-43001",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43001"
},
{
"name": "CVE-2024-53677",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53677"
},
{
"name": "CVE-2025-30010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30010"
},
{
"name": "CVE-2025-42997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42997"
},
{
"name": "CVE-2025-42965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42965"
},
{
"name": "CVE-2025-30018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30018"
},
{
"name": "CVE-2025-42967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42967"
},
{
"name": "CVE-2025-42980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42980"
},
{
"name": "CVE-2025-42964",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42964"
},
{
"name": "CVE-2025-42992",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42992"
},
{
"name": "CVE-2025-42973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42973"
},
{
"name": "CVE-2025-42960",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42960"
}
],
"initial_release_date": "2025-07-08T00:00:00",
"last_revision_date": "2025-07-08T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0564",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-07-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP july-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html"
}
]
}
CERTFR-2025-AVI-0487
Vulnerability from certfr_avis - Published: 2025-06-11 - Updated: 2025-06-11
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une falsification de requêtes côté serveur (SSRF).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | Business Objects Business Intelligence Platform | Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | NetWeaver | NetWeaver (ABAP Keyword Documentation) versions SAP_BASIS 758 | ||
| SAP | NetWeaver Visual Composer | NetWeaver Visual Composer versions VCBASE 7.50 | ||
| SAP | Business One Integration Framework | Business One Integration Framework versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 | ||
| SAP | MDM Server | MDM Server versions 710.750 | ||
| SAP | S/4HANA | S/4HANA (Manage Processing Rules - For Bank Statement) versions S4CORE 104, 105, 106, 107 et 108 | ||
| SAP | SAPUI5 applications | SAPUI5 applications versions SAP_UI 750, 754, 755, 756, 757, 758 et UI_700 200 | ||
| SAP | S/4HANA | S/4HANA (Manage Central Purchase Contract application) versions S4CORE 106, 107 et 108 | ||
| SAP | S/4HANA | S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758 | ||
| SAP | GRC | GRC (AC Plugin) versions GRCPINW V1100_700 et V1100_731 | ||
| SAP | BusinessObjects Business Intelligence | BusinessObjects Business Intelligence (BI Workspace) versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | S/4HANA | S/4HANA (Bank Account Application) versions S4CORE 108 | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server for ABAP versions KERNEL 7.89, 7.93, 9.14 et 9.15 | ||
| SAP | Business Warehouse et SAP Plug-In Basis | Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, 758, 914 et 915 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (ABAP Keyword Documentation) versions SAP_BASIS 758",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Visual Composer versions VCBASE 7.50",
"product": {
"name": "NetWeaver Visual Composer",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One Integration Framework versions B1_ON_HANA 10.0 et SAP-M-BO 10.0",
"product": {
"name": "Business One Integration Framework",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "MDM Server versions 710.750",
"product": {
"name": "MDM Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Manage Processing Rules - For Bank Statement) versions S4CORE 104, 105, 106, 107 et 108",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 applications versions SAP_UI 750, 754, 755, 756, 757, 758 et UI_700 200",
"product": {
"name": "SAPUI5 applications",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Manage Central Purchase Contract application) versions S4CORE 106, 107 et 108",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GRC (AC Plugin) versions GRCPINW V1100_700 et V1100_731",
"product": {
"name": "GRC",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence (BI Workspace) versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Bank Account Application) versions S4CORE 108",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions KERNEL 7.89, 7.93, 9.14 et 9.15",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, 758, 914 et 915",
"product": {
"name": "Business Warehouse et SAP Plug-In Basis",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42987",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42987"
},
{
"name": "CVE-2025-42991",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42991"
},
{
"name": "CVE-2025-42996",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42996"
},
{
"name": "CVE-2025-42988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42988"
},
{
"name": "CVE-2025-42995",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42995"
},
{
"name": "CVE-2025-42984",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42984"
},
{
"name": "CVE-2025-42982",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42982"
},
{
"name": "CVE-2025-42993",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42993"
},
{
"name": "CVE-2025-42977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42977"
},
{
"name": "CVE-2025-31325",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31325"
},
{
"name": "CVE-2025-42983",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42983"
},
{
"name": "CVE-2025-42998",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42998"
},
{
"name": "CVE-2025-42989",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42989"
},
{
"name": "CVE-2025-42994",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42994"
},
{
"name": "CVE-2025-23192",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23192"
},
{
"name": "CVE-2025-42990",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42990"
}
],
"initial_release_date": "2025-06-11T00:00:00",
"last_revision_date": "2025-06-11T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0487",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-06-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-06-10",
"title": "Bulletin de s\u00e9curit\u00e9 SAP june-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html"
}
]
}
CERTFR-2025-AVI-0396
Vulnerability from certfr_avis - Published: 2025-05-13 - Updated: 2025-06-12
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA | S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102 | ||
| SAP | NetWeaver | NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50 | ||
| SAP | N/A | Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025 | ||
| SAP | N/A | Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | N/A | Data Services Management Console version SBOP DS JOB SERVER 4.3 | ||
| SAP | N/A | Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0 | ||
| SAP | N/A | Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | S/4HANA | S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106 | ||
| SAP | S/4HANA | S/4HANA (Private Cloud & On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714 | ||
| SAP | S/4HANA | S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714 | ||
| SAP | N/A | Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | N/A | Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103 | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 | ||
| SAP | N/A | Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | N/A | GUI for Windows version BC-FES-GUI 8.00 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Services Management Console version SBOP DS JOB SERVER 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud \u0026 On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI for Windows version BC-FES-GUI 8.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43003",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43003"
},
{
"name": "CVE-2025-43007",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43007"
},
{
"name": "CVE-2025-23191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23191"
},
{
"name": "CVE-2025-42999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42999"
},
{
"name": "CVE-2025-43009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43009"
},
{
"name": "CVE-2025-43011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43011"
},
{
"name": "CVE-2025-43006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43006"
},
{
"name": "CVE-2025-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0060"
},
{
"name": "CVE-2025-30012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30012"
},
{
"name": "CVE-2025-43000",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43000"
},
{
"name": "CVE-2025-43004",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43004"
},
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
},
{
"name": "CVE-2025-43005",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43005"
},
{
"name": "CVE-2025-43008",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43008"
},
{
"name": "CVE-2025-31329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31329"
},
{
"name": "CVE-2025-30009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30009"
},
{
"name": "CVE-2025-30011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30011"
},
{
"name": "CVE-2025-43002",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43002"
},
{
"name": "CVE-2025-26662",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26662"
},
{
"name": "CVE-2025-30010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30010"
},
{
"name": "CVE-2025-42997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42997"
},
{
"name": "CVE-2025-0061",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0061"
},
{
"name": "CVE-2025-43010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43010"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2025-30018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30018"
}
],
"initial_release_date": "2025-05-13T00:00:00",
"last_revision_date": "2025-06-12T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0396",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-13T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE CVE-2025-0060, CVE-2025-0061 et CVE-2025-23191",
"revision_date": "2025-06-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-05-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP may-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html"
}
]
}
CERTFR-2025-AVI-0285
Vulnerability from certfr_avis - Published: 2025-04-08 - Updated: 2025-04-25
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur indique que la vulnérabilité CVE-2025-31324 est activement exploitée.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA (Private Cloud) | S/4HANA (Learning Solution) versions S4HCMGXX 100 et 101 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 et 9.14 sans le dernier correctif de sécurité | ||
| SAP | SAP BusinessObjects Business Intelligence | BusinessObjects Business Intelligence platform (Central Management Console) versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server ABAP (Virus Scan Interface) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver et ABAP Platform (Service Data Collection) versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de sécurité | ||
| SAP | S4CORE entity | S4CORE entity versions S4CORE 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | ERP BW Business Content | ERP BW Business Content versions BI_CONT 707, 737, 747 et 757 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud (Public Cloud) version COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Field Logistics versions S4CORE 107 et 108 sans le dernier correctif | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver et ABAP Platform (Application Server ABAP) versions KRNL64UC 7.53, KERNEL 7.53 et 7.54 sans le dernier correctif de sécurité | ||
| SAP | Solution Manager | Solution Manager versions ST 720, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | Capital Yield Tax Management | Capital Yield Tax Management versions CYTERP 420_700, CYT 800, IBS 7.0 et CYT4HANA 100 sans le dernier correctif de sécurité | ||
| SAP | SAP BusinessObjects Business Intelligence | BusinessObjects Business Intelligence Platform version ENTERPRISE 430 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA (Private Cloud) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | CRM | CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité | ||
| SAP | KMC WPC | KMC WPC version KMC-WPC 7.50 sans le dernier correctif de sécurité | ||
| SAP | Landscape Transformation | Landscape Transformation (Analysis Platform) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730 et 2011_1_731 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA (Learning Solution) versions S4HCMGXX 100 et 101 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence platform (Central Management Console) versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (Virus Scan Interface) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et ABAP Platform (Service Data Collection) versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4CORE entity versions S4CORE 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S4CORE entity",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ERP BW Business Content versions BI_CONT 707, 737, 747 et 757 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "ERP BW Business Content",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud (Public Cloud) version COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9\n",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Field Logistics versions S4CORE 107 et 108 sans le dernier correctif",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et ABAP Platform (Application Server ABAP) versions KRNL64UC 7.53, KERNEL 7.53 et 7.54 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Manager versions ST 720, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Solution Manager",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Capital Yield Tax Management versions CYTERP 420_700, CYT 800, IBS 7.0 et CYT4HANA 100 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Capital Yield Tax Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform version ENTERPRISE 430 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "CRM",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "KMC WPC version KMC-WPC 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "KMC WPC",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation (Analysis Platform) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730 et 2011_1_731 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Landscape Transformation",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur indique que la vuln\u00e9rabilit\u00e9 CVE-2025-31324 est activement exploit\u00e9e.",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-30015",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30015"
},
{
"name": "CVE-2025-31333",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31333"
},
{
"name": "CVE-2025-27429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27429"
},
{
"name": "CVE-2025-27428",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27428"
},
{
"name": "CVE-2025-0064",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0064"
},
{
"name": "CVE-2025-23186",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23186"
},
{
"name": "CVE-2025-27435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27435"
},
{
"name": "CVE-2025-26654",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26654"
},
{
"name": "CVE-2025-26653",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26653"
},
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
},
{
"name": "CVE-2025-30014",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30014"
},
{
"name": "CVE-2024-56337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56337"
},
{
"name": "CVE-2025-27437",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27437"
},
{
"name": "CVE-2025-30016",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30016"
},
{
"name": "CVE-2025-31332",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31332"
},
{
"name": "CVE-2025-26657",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26657"
},
{
"name": "CVE-2025-31328",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31328"
},
{
"name": "CVE-2025-30013",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30013"
},
{
"name": "CVE-2025-30017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30017"
},
{
"name": "CVE-2025-27430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27430"
},
{
"name": "CVE-2025-31331",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31331"
},
{
"name": "CVE-2025-31330",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31330"
},
{
"name": "CVE-2025-31327",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31327"
}
],
"initial_release_date": "2025-04-08T00:00:00",
"last_revision_date": "2025-04-25T00:00:00",
"links": [
{
"title": "FAQ sur l\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2025-31324",
"url": "https://me.sap.com/notes/3596125"
}
],
"reference": "CERTFR-2025-AVI-0285",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-08T00:00:00.000000"
},
{
"description": "Ajout des vuln\u00e9rabilit\u00e9s CVE-2025-31324, CVE-2025-31328 et CVE-2025-31327",
"revision_date": "2025-04-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-04-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP april-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html"
}
]
}
CERTFR-2024-AVI-0844
Vulnerability from certfr_avis - Published: 2024-10-08 - Updated: 2024-10-08
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver BW | NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Backoffice versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4 HANA (Manage Bank Statements) versions S4CORE, 102, 103, 104, 105, 106 et 107 sans le dernier correctif de sécurité | ||
| SAP | N/A | Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal (KMC) version KMC-BC 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 420, 430, 2025, ENTERPRISECLIENTTOOLS 420, 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | HANA Client version HDB_CLIENT 2.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS for Java version 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | SAP NetWeaver Application Server pour plateformes ABAP et ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enterprise Project Connection version 3.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver BW",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Backoffice versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA (Manage Bank Statements) versions S4CORE, 102, 103, 104, 105, 106 et 107 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal (KMC) version KMC-BC 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 420, 430, 2025, ENTERPRISECLIENTTOOLS 420, 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA Client version HDB_CLIENT 2.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for Java version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server pour plateformes ABAP et ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enterprise Project Connection version 3.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-45282",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45282"
},
{
"name": "CVE-2024-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42373"
},
{
"name": "CVE-2024-38809",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38809"
},
{
"name": "CVE-2024-41729",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41729"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-45278",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45278"
},
{
"name": "CVE-2024-45283",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45283"
},
{
"name": "CVE-2024-45277",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45277"
},
{
"name": "CVE-2024-38808",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38808"
},
{
"name": "CVE-2024-47594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47594"
},
{
"name": "CVE-2022-23302",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23302"
},
{
"name": "CVE-2024-22259",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22259"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2024-41730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
},
{
"name": "CVE-2024-37179",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37179"
}
],
"initial_release_date": "2024-10-08T00:00:00",
"last_revision_date": "2024-10-08T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0844",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP october-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2024.html"
}
]
}
CERTFR-2024-AVI-0754
Vulnerability from certfr_avis - Published: 2024-09-10 - Updated: 2024-09-10
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAP pour Oil & Gas | SAP pour Oil & Gas versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806, 807 et 807 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | Business Warehouse | Business Warehouse (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA (Manage Incoming Payment Files) | S/4 HANA version 900 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver BW | NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de sécurité | ||
| SAP | SAP NetWeaver AS Java | NetWeaver AS pour Java (Destination Service et Logon Application) version 7.50 sans le dernier correctif de sécurité | ||
| SAP | SAP BusinessObjects Business Intelligence | BusinessObjects Business Intelligence Platform version 430 sans le dernier correctif de sécurité | ||
| SAP | SAP Student Life Cycle Management | Student Life Cycle Management (SLcM) versions 617, 618, 800, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | SAP BusinessObjects Business Intelligence | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | Replication Server | Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server pour ABAP et ABAP Platform, Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 912 sans le dernier correctif de sécurité | ||
| SAP | Production et Revenue Accounting | Production et Revenue Accounting (Tobin interface) versions S4CEXT 106, S4CEXT 107, S4CEXT 108, IS-PRA 605, IS-PRA 606, IS-PRA 616, IS-PRA 617, IS-PRA 618, IS-PRA 800, IS-PRA 801, IS-PRA 802, IS-PRA 803, IS-PRA 804 et IS-PRA 805 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal version 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server pour ABAP (CRM Blueprint Application Builder Panel) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de sécurité | ||
| SAP | S/4HANA eProcurement | S/4HANA eProcurement versions SAP_APPL 606, SAP_APPL 617, SAP_APPL 618, S4CORE 102, S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP pour Oil \u0026 Gas versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806, 807 et 807 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP pour Oil \u0026 Gas",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA version 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA (Manage Incoming Payment Files)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver BW",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS pour Java (Destination Service et Logon Application) version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform version 430 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management (SLcM) versions 617, 618, 800, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP Student Life Cycle Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Replication Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server pour ABAP et ABAP Platform, Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 912 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Production et Revenue Accounting (Tobin interface) versions S4CEXT 106, S4CEXT 107, S4CEXT 108, IS-PRA 605, IS-PRA 606, IS-PRA 616, IS-PRA 617, IS-PRA 618, IS-PRA 800, IS-PRA 801, IS-PRA 802, IS-PRA 803, IS-PRA 804 et IS-PRA 805 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Production et Revenue Accounting",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP (CRM Blueprint Application Builder Panel) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA eProcurement versions SAP_APPL 606, SAP_APPL 617, SAP_APPL 618, S4CORE 102, S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA eProcurement",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-45281",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45281"
},
{
"name": "CVE-2024-44115",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44115"
},
{
"name": "CVE-2024-45279",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45279"
},
{
"name": "CVE-2024-44117",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44117"
},
{
"name": "CVE-2024-33003",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33003"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2024-45285",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45285"
},
{
"name": "CVE-2024-45286",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45286"
},
{
"name": "CVE-2024-44116",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44116"
},
{
"name": "CVE-2024-44113",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44113"
},
{
"name": "CVE-2024-41729",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41729"
},
{
"name": "CVE-2024-44112",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44112"
},
{
"name": "CVE-2024-41728",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41728"
},
{
"name": "CVE-2024-42371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42371"
},
{
"name": "CVE-2024-42380",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42380"
},
{
"name": "CVE-2024-45280",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45280"
},
{
"name": "CVE-2024-45283",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45283"
},
{
"name": "CVE-2013-3587",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-3587"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2024-45284",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45284"
},
{
"name": "CVE-2024-44114",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44114"
},
{
"name": "CVE-2024-41730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
},
{
"name": "CVE-2024-44121",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44121"
},
{
"name": "CVE-2024-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42378"
},
{
"name": "CVE-2024-44120",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44120"
}
],
"initial_release_date": "2024-09-10T00:00:00",
"last_revision_date": "2024-09-10T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0754",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-09-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 SAP",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2024.html"
}
]
}
CERTFR-2024-AVI-0477
Vulnerability from certfr_avis - Published: 2024-06-11 - Updated: 2024-06-11
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA (Manage Incoming Payment Files) | S/4HANA (Manage Incoming Payment Files) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | SAP Document Builder | Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java version GP-CORE 7.5 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP et ABAP Platform versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de sécurité | ||
| SAP | Central Finance Infrastructure Components | Central Finance Infrastructure Components versions SAP_FIN 720, 730, SAPSCORE 114, S4CORE 100, 101 et 102 sans le dernier correctif de sécurité | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de sécurité | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de sécurité | ||
| SAP | SAP Financial Consolidation | Financial Consolidation version FINANCE 1010 sans le dernier correctif de sécurité | ||
| SAP | SAP BW/4HANA Transformation et Data Transfer Process | BW/4HANA Transformation et Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | SAP Student Life Cycle Management | Student Life Cycle Management versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | SAP CRM WebClient UI | CRM WebClient UI versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA (Manage Incoming Payment Files) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA (Manage Incoming Payment Files)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP Document Builder",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java version GP-CORE 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Central Finance Infrastructure Components versions SAP_FIN 720, 730, SAPSCORE 114, S4CORE 100, 101 et 102 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Central Finance Infrastructure Components",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Financial Consolidation version FINANCE 1010 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP Financial Consolidation",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BW/4HANA Transformation et Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BW/4HANA Transformation et Data Transfer Process",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP Student Life Cycle Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM WebClient UI versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP CRM WebClient UI",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-37176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37176"
},
{
"name": "CVE-2024-34691",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34691"
},
{
"name": "CVE-2024-37177",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37177"
},
{
"name": "CVE-2024-34686",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34686"
},
{
"name": "CVE-2024-34683",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
},
{
"name": "CVE-2024-34688",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34688"
},
{
"name": "CVE-2024-32733",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32733"
},
{
"name": "CVE-2024-34684",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34684"
},
{
"name": "CVE-2024-33001",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33001"
},
{
"name": "CVE-2024-34690",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34690"
},
{
"name": "CVE-2024-28164",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28164"
}
],
"initial_release_date": "2024-06-11T00:00:00",
"last_revision_date": "2024-06-11T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0477",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-06-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 SAP june-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2024.html"
}
]
}
CERTFR-2024-AVI-0395
Vulnerability from certfr_avis - Published: 2024-05-14 - Updated: 2024-05-14
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Enable Now version 1704 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Client versions 6.5, 7.0 et 7.70 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de sécurité | ||
| SAP | N/A | SAPUI5 versions 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce version HY_COM 2205 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP S/4 HANA (Manage Bank Statement Reprocessing Rules) versions SAPSCORE 131, S4CORE 105, S4CORE 106, S4CORE107 et S4CORE 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP BusinessObjects Business Intelligence Platform (Webservices) versions 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | Replication Server | AP Replication Server versions 16.0, 16.0.3 et 16.0.4 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA (Document Service Handler for DPS) versions SAP_BASIS 740 et SAP_BASIS 750 sans le dernier correctif de sécurité | ||
| SAP | N/A | My Travel Requests version 600 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects (Business Intelligence Platform) versions 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP Bank Account Management versions 100, 101, 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP Global Label Management (GLM) versions 605, 606, 616 et 617 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Enable Now version 1704 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Client versions 6.5, 7.0 et 7.70 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce version HY_COM 2205 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP S/4 HANA (Manage Bank Statement Reprocessing Rules) versions SAPSCORE 131, S4CORE 105, S4CORE 106, S4CORE107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP BusinessObjects Business Intelligence Platform (Webservices) versions 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP Replication Server versions 16.0, 16.0.3 et 16.0.4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Replication Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Document Service Handler for DPS) versions SAP_BASIS 740 et SAP_BASIS 750 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "My Travel Requests version 600 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects (Business Intelligence Platform) versions 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP Bank Account Management versions 100, 101, 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP Global Label Management (GLM) versions 605, 606, 616 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-34687",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34687"
},
{
"name": "CVE-2024-33008",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33008"
},
{
"name": "CVE-2024-4138",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4138"
},
{
"name": "CVE-2022-36364",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36364"
},
{
"name": "CVE-2024-4139",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4139"
},
{
"name": "CVE-2019-17495",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17495"
},
{
"name": "CVE-2024-32733",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32733"
},
{
"name": "CVE-2024-33009",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33009"
},
{
"name": "CVE-2024-33002",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33002"
},
{
"name": "CVE-2024-28165",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28165"
},
{
"name": "CVE-2024-32731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32731"
},
{
"name": "CVE-2024-32730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32730"
},
{
"name": "CVE-2024-33000",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33000"
},
{
"name": "CVE-2024-33007",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33007"
},
{
"name": "CVE-2024-33004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33004"
},
{
"name": "CVE-2024-33006",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33006"
}
],
"initial_release_date": "2024-05-14T00:00:00",
"last_revision_date": "2024-05-14T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0395",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-05-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 14 mai 2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html"
}
]
}
CERTFR-2024-AVI-0125
Vulnerability from certfr_avis - Published: 2024-02-14 - Updated: 2024-02-14
De multiples vulnérabilités ont été découvertes dans SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702 | ||
| SAP | N/A | SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731 | ||
| SAP | N/A | SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java (Guided Procedures) version 7.50 | ||
| SAP | N/A | SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804 | ||
| SAP | N/A | SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java (User Admin Application) version 7.50 | ||
| SAP | N/A | SAP Cloud Connector version 2.0 | ||
| SAP | N/A | SAP Fiori app ("My Overtime Requests") versions 605 | ||
| SAP | N/A | IDES Systems toutes versions | ||
| SAP | N/A | SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I | ||
| SAP | N/A | SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | N/A | BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101 | ||
| SAP | N/A | SAP Companion versions antérieures à 3.1.38 | ||
| SAP | SAP CRM WebClient UI | SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java (Guided Procedures) version 7.50",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java (User Admin Application) version 7.50",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Cloud Connector version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori app (\"My Overtime Requests\") versions 605",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "IDES Systems toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Companion versions ant\u00e9rieures \u00e0 3.1.38",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
"product": {
"name": "SAP CRM WebClient UI",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-24741",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24741"
},
{
"name": "CVE-2024-22132",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22132"
},
{
"name": "CVE-2024-24739",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24739"
},
{
"name": "CVE-2023-49580",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49580"
},
{
"name": "CVE-2024-25643",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25643"
},
{
"name": "CVE-2024-24742",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24742"
},
{
"name": "CVE-2024-25642",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25642"
},
{
"name": "CVE-2024-24740",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24740"
},
{
"name": "CVE-2024-22129",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22129"
},
{
"name": "CVE-2024-22126",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22126"
},
{
"name": "CVE-2024-22128",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22128"
},
{
"name": "CVE-2024-22131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22131"
},
{
"name": "CVE-2024-22130",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22130"
},
{
"name": "CVE-2023-49058",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49058"
},
{
"name": "CVE-2024-24743",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24743"
}
],
"initial_release_date": "2024-02-14T00:00:00",
"last_revision_date": "2024-02-14T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0125",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-02-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SAP. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP february-2024 du 13 f\u00e9vrier 2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2024.html"
}
]
}
CERTFR-2024-AVI-0018
Vulnerability from certfr_avis - Published: 2024-01-10 - Updated: 2024-01-10
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Business Application Studio, Web IDE Full-Stack et Web IDE pour SAP HANA | ||
| SAP | N/A | NetWeaver (Internet Communication Manager) versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53 et WEBDISP 7.54 | ||
| SAP | Replication Server | LT Replication Server versions S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 | ||
| SAP | N/A | Business Technology Platform (BTP) Security Services Integration Libraries | ||
| SAP | N/A | NetWeaver AS ABAP et ABAP Platform versions KRNL64UC 7.53, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.94, KERNEL 7.93 et KERNEL 7.95 | ||
| SAP | N/A | S/4HANA Finance (Advanced Payment Management) versions SAPSCORE 128 et S4CORE 10 | ||
| SAP | N/A | NetWeaver ABAP Application Server et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793 et SAP_BASIS 79 | ||
| SAP | N/A | NetWeaver AS for Java (Log Viewer) version ENGINEAPI 7.50, SERVERCORE 7.50 et J2EE-APPS 7.50 | ||
| SAP | N/A | Marketing (Contacts App) version 160 | ||
| SAP | N/A | Web Dispatcher versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.90, WEBDISP 7.94 et WEBDISP 7.95 | ||
| SAP | N/A | Edge Integration Cell versions supérieures ou égales à 8.9.13 | ||
| SAP | N/A | Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) version 1.0 | ||
| SAP | N/A | Application Interface Framework (File Adapter) version 702 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Business Application Studio, Web IDE Full-Stack et Web IDE pour SAP HANA",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Internet Communication Manager) versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53 et WEBDISP 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "LT Replication Server versions S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108",
"product": {
"name": "Replication Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Technology Platform (BTP) Security Services Integration Libraries",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP et ABAP Platform versions KRNL64UC 7.53, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.94, KERNEL 7.93 et KERNEL 7.95",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Finance (Advanced Payment Management) versions SAPSCORE 128 et S4CORE 10",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Application Server et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793 et SAP_BASIS 79",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for Java (Log Viewer) version ENGINEAPI 7.50, SERVERCORE 7.50 et J2EE-APPS 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Marketing (Contacts App) version 160",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.90, WEBDISP 7.94 et WEBDISP 7.95",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Edge Integration Cell versions sup\u00e9rieures ou \u00e9gales \u00e0 8.9.13",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) version 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Application Interface Framework (File Adapter) version 702",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-21736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21736"
},
{
"name": "CVE-2024-21734",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21734"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-31405",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31405"
},
{
"name": "CVE-2024-21738",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21738"
},
{
"name": "CVE-2024-22124",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22124"
},
{
"name": "CVE-2024-21735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21735"
},
{
"name": "CVE-2024-21737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21737"
},
{
"name": "CVE-2023-50423",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50423"
},
{
"name": "CVE-2023-49583",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49583"
},
{
"name": "CVE-2024-22125",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22125"
},
{
"name": "CVE-2023-50422",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50422"
},
{
"name": "CVE-2023-50424",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50424"
}
],
"initial_release_date": "2024-01-10T00:00:00",
"last_revision_date": "2024-01-10T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0018",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-01-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 09 janvier 2024",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-1020
Vulnerability from certfr_avis - Published: 2023-12-13 - Updated: 2023-12-13
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP EMARSYS SDK ANDROID version 3.6.2 | ||
| SAP | N/A | Librairie cloud-security-services-integration-library versions antérieures à 2.17.0 | ||
| SAP | N/A | SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604 et SAP_HRCIE 608 | ||
| SAP | N/A | SAP Master Data Governance versions 731, 732, 746, 747, 748, 749, 800, 751,752,801,802, 803, 804, 805, 806, 807 et 808 | ||
| SAP | N/A | Business Objects BI Platform versions 420 et 430 | ||
| SAP | N/A | SAP BusinessObjects Web Intelligence version 420 | ||
| SAP | N/A | SAP Biller Direct versions 635 et 750 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200 | ||
| SAP | N/A | SAP Cloud Connector version 2.0 | ||
| SAP | N/A | Librairie sap-xssec versions antérieures à 4.1.0 | ||
| SAP | N/A | Librairie github.com/sap/cloud-security-client-go versions antérieures à 0.17.0 | ||
| SAP | Commerce Cloud | SAP Commerce Cloud version 8.1 | ||
| SAP | N/A | SAP Solution Manager version 720 | ||
| SAP | N/A | Librairie @sap/xssec versions antérieures à 3.6.0 | ||
| SAP | N/A | SAP ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807 | ||
| SAP | N/A | SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS731, SAP_BASIS740 et SAP_BASIS750 | ||
| SAP | N/A | SAP_BS_FND version 702 | ||
| SAP | N/A | Librairie cloud-security-services-integration-library versions 3.3.x antérieures à 3.3.0 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.7 | ||
| SAP | N/A | SAP Fiori Launchpad versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200 et SAP_BASIS 793 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP EMARSYS SDK ANDROID version 3.6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie cloud-security-services-integration-library versions ant\u00e9rieures \u00e0 2.17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604 et SAP_HRCIE 608",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Master Data Governance versions 731, 732, 746, 747, 748, 749, 800, 751,752,801,802, 803, 804, 805, 806, 807 et 808",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects BI Platform versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Web Intelligence version 420",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Biller Direct versions 635 et 750",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Cloud Connector version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie sap-xssec versions ant\u00e9rieures \u00e0 4.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie github.com/sap/cloud-security-client-go versions ant\u00e9rieures \u00e0 0.17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce Cloud version 8.1",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Solution Manager version 720",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie @sap/xssec versions ant\u00e9rieures \u00e0 3.6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS731, SAP_BASIS740 et SAP_BASIS750",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP_BS_FND version 702",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie cloud-security-services-integration-library versions 3.3.x ant\u00e9rieures \u00e0 3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori Launchpad versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200 et SAP_BASIS 793",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-49587",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49587"
},
{
"name": "CVE-2023-42481",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42481"
},
{
"name": "CVE-2023-49584",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49584"
},
{
"name": "CVE-2023-49581",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49581"
},
{
"name": "CVE-2023-36922",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36922"
},
{
"name": "CVE-2023-42476",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42476"
},
{
"name": "CVE-2023-49580",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49580"
},
{
"name": "CVE-2023-6542",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6542"
},
{
"name": "CVE-2023-42479",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42479"
},
{
"name": "CVE-2023-42478",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42478"
},
{
"name": "CVE-2021-23413",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23413"
},
{
"name": "CVE-2023-50423",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50423"
},
{
"name": "CVE-2023-49583",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49583"
},
{
"name": "CVE-2023-49577",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49577"
},
{
"name": "CVE-2023-49578",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49578"
},
{
"name": "CVE-2023-50422",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50422"
},
{
"name": "CVE-2023-49058",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49058"
},
{
"name": "CVE-2023-50424",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50424"
}
],
"initial_release_date": "2023-12-13T00:00:00",
"last_revision_date": "2023-12-13T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-1020",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-12-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP ucQrx6G du 12 d\u00e9cembre 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0942
Vulnerability from certfr_avis - Published: 2023-11-15 - Updated: 2023-11-15
De multiples vulnérabilités ont été découvertes dans les produits SAP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java version 7.5 | ||
| SAP | N/A | SAPSSOEXT version 17 | ||
| SAP | N/A | SAPExtended Application Services et Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00 | ||
| SAP | N/A | SAPHost Agent version 722 | ||
| SAP | N/A | Product-SAP IQ version 16.0 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89 | ||
| SAP | N/A | Product-SAP ASE versions 15.7, 16.0 | ||
| SAP | N/A | SAP Business One version 10.0 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP et ABAP Platform versions KERNEL 722, KERNEL 7.53, KERNEL 7.77,KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT | ||
| SAP | N/A | Product-SAP SQL Anywhere versions 16.0, 17.0 | ||
| SAP | N/A | SAP CommonCryptoLib version 8 | ||
| SAP | N/A | Product-SAP ASE Cluster Edition version 15.7 | ||
| SAP | N/A | Product-SAP Event Stream Processor version 5.1 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS ABAP, SAP NetWeaver AS Java et ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT | ||
| SAP | N/A | SAPHANA Database version 2.0 | ||
| SAP | N/A | SAPContent Server versions 6.50, 7.53, 7.54 | ||
| SAP | Replication Server | Product-SAP Replication Server version 15.7 | ||
| SAP | N/A | NetWeaver AS Java version 7.50 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP NetWeaver AS Java version 7.5",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPSSOEXT version 17",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPExtended Application Services et Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHost Agent version 722",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP IQ version 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP ASE versions 15.7, 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business One version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions KERNEL 722, KERNEL 7.53, KERNEL 7.77,KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP SQL Anywhere versions 16.0, 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CommonCryptoLib version 8",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP ASE Cluster Edition version 15.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP Event Stream Processor version 5.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java et ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHANA Database version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPContent Server versions 6.50, 7.53, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP Replication Server version 15.7",
"product": {
"name": "Replication Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-40309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40309"
},
{
"name": "CVE-2023-42477",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42477"
},
{
"name": "CVE-2023-31403",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31403"
},
{
"name": "CVE-2023-42480",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42480"
},
{
"name": "CVE-2023-41366",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41366"
}
],
"initial_release_date": "2023-11-15T00:00:00",
"last_revision_date": "2023-11-15T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0942",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-11-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un contournement de la politique de s\u00e9curit\u00e9 et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP ucQrx6G du 14 novembre 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0737
Vulnerability from certfr_avis - Published: 2023-09-13 - Updated: 2023-09-13
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Business Objects Business Intelligence Platform (CMC) versions 420 et 430 | ||
| SAP | N/A | SAP S/4HANA (Create Single Payment application) versions 100, 101, 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (versions Management System) versions 430 | ||
| SAP | N/A | SAPExtended Application Services and Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00 | ||
| SAP | N/A | SAP NetWeaver Process Integration versions 7.50 | ||
| SAP | N/A | SAPHANA Database versions 2.0 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89 | ||
| SAP | N/A | S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106 et 107 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | N/A | SAP NetWeaver AS ABAP (applications based on Unified Rendering) versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702 et SAP_BASIS 731 | ||
| SAP | N/A | SAP NetWeaver (Guided Procedures) versions 7.50 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200 | ||
| SAP | N/A | SAPSSOEXT versions 17 | ||
| SAP | N/A | Product-SAP BusinessObjects Suite (Installer) versions 420 et 430 | ||
| SAP | N/A | SAP Quotation Management Insurance (FS-QUO) versions 400, 510, 700 et 800 | ||
| SAP | N/A | SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106 | ||
| SAP | N/A | SAPHost Agent versions 722 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) versions 420 | ||
| SAP | N/A | SAPContent Server versions 6.50, 7.53, 7.54 | ||
| SAP | N/A | SAP PowerDesignerClient versions 16.7 | ||
| SAP | N/A | S4 HANA ABAP (Manage checkbook apps) versions 102, 103, 104, 105, 106 et 107 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22 et KERNEL64NUC 7.22EXT |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Business Objects Business Intelligence Platform (CMC) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA (Create Single Payment application) versions 100, 101, 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (versions Management System) versions 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPExtended Application Services and Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration versions 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHANA Database versions 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106 et 107",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP (applications based on Unified Rendering) versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702 et SAP_BASIS 731",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Guided Procedures) versions 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPSSOEXT versions 17",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP BusinessObjects Suite (Installer) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Quotation Management Insurance (FS-QUO) versions 400, 510, 700 et 800",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHost Agent versions 722",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) versions 420",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPContent Server versions 6.50, 7.53, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP PowerDesignerClient versions 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4 HANA ABAP (Manage checkbook apps) versions 102, 103, 104, 105, 106 et 107",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22 et KERNEL64NUC 7.22EXT",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-40309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40309"
},
{
"name": "CVE-2023-25616",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25616"
},
{
"name": "CVE-2023-40306",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40306"
},
{
"name": "CVE-2021-41182",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41182"
},
{
"name": "CVE-2023-41367",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41367"
},
{
"name": "CVE-2023-40624",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40624"
},
{
"name": "CVE-2023-41369",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41369"
},
{
"name": "CVE-2023-40621",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40621"
},
{
"name": "CVE-2023-41368",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41368"
},
{
"name": "CVE-2022-41272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
},
{
"name": "CVE-2023-37489",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37489"
},
{
"name": "CVE-2023-42472",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42472"
},
{
"name": "CVE-2021-41184",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41184"
},
{
"name": "CVE-2021-41183",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41183"
},
{
"name": "CVE-2023-40308",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40308"
},
{
"name": "CVE-2023-40622",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40622"
},
{
"name": "CVE-2023-40625",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40625"
},
{
"name": "CVE-2023-40623",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40623"
},
{
"name": "CVE-2023-24998",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
}
],
"initial_release_date": "2023-09-13T00:00:00",
"last_revision_date": "2023-09-13T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0737",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-09-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2023-09-12",
"title": "Bulletin de s\u00e9curit\u00e9 SAP",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026d=2023-09-13"
}
]
}
CERTFR-2023-AVI-0454
Vulnerability from certfr_avis - Published: 2023-06-14 - Updated: 2023-06-14
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Knowledge Warehouse versions 7.30, 7.31, 7.40 et 7.50 | ||
| SAP | N/A | Master Data Synchronization (MDS COMPARE TOOL) versions SAP_APPL 600, 602, 603, 604, 605, 606 et 616 | ||
| SAP | N/A | SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80 | ||
| SAP | N/A | SAP CRM ABAP (Grantor Management) version 430 | ||
| SAP | N/A | SAP NetWeaver (Change and Transport System) versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | N/A | SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) versions 104, 105 et 106 | ||
| SAP | N/A | SAP NetWeaver (Design Time Repository) version 7.50 | ||
| SAP | N/A | SAP UI5 Variant Management versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP Plant Connectivity version 15.5 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal version 7.50 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Knowledge Warehouse versions 7.30, 7.31, 7.40 et 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Master Data Synchronization (MDS COMPARE TOOL) versions SAP_APPL 600, 602, 603, 604, 605, 606 et 616",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM ABAP (Grantor Management) version 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Change and Transport System) versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) versions 104, 105 et 106",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Design Time Repository) version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP UI5 Variant Management versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Plant Connectivity version 15.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal version 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-42063",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42063"
},
{
"name": "CVE-2023-32115",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32115"
},
{
"name": "CVE-2023-33991",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33991"
},
{
"name": "CVE-2023-33986",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33986"
},
{
"name": "CVE-2023-2827",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2827"
},
{
"name": "CVE-2023-30743",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30743"
},
{
"name": "CVE-2023-33984",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33984"
},
{
"name": "CVE-2023-30742",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30742"
},
{
"name": "CVE-2023-32114",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32114"
},
{
"name": "CVE-2023-31406",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31406"
},
{
"name": "CVE-2022-22542",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22542"
},
{
"name": "CVE-2023-33985",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33985"
}
],
"initial_release_date": "2023-06-14T00:00:00",
"last_revision_date": "2023-06-14T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0454",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 13 juin 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0369
Vulnerability from certfr_avis - Published: 2023-05-10 - Updated: 2023-05-10
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP 3D Visual Enterprise License Manager version 15 | ||
| SAP | N/A | SAP Commerce versions 2211, 2105 et 2205 | ||
| SAP | N/A | SAP Application Interface Framework (ODATA service) versions 755 et 756 | ||
| SAP | N/A | SAP Commerce (Backoffice) versions 2105 et 2205 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | SAP CRM WebClient UI | SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 20 | ||
| SAP | N/A | SAP GUI pour Windows versions 7.70 et 8.0 | ||
| SAP | N/A | SAP IBP EXCEL ADD-IN versions 2211, 2302 et 2305 | ||
| SAP | N/A | SAP BusinessObjects Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50 et CORE-TOOLS 7.50 | ||
| SAP | N/A | Vendor Master Hierarchy versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618 et S4CORE 100 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Central Management Service) versions 420 et 430 | ||
| SAP | N/A | SAP PowerDesigner (Proxy) version 16.7 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP 3D Visual Enterprise License Manager version 15",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 2211, 2105 et 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (ODATA service) versions 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce (Backoffice) versions 2105 et 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80",
"product": {
"name": "SAP CRM WebClient UI",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 20",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI pour Windows versions 7.70 et 8.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP IBP EXCEL ADD-IN versions 2211, 2302 et 2305",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Intelligence Platform versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50 et CORE-TOOLS 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Vendor Master Hierarchy versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618 et S4CORE 100",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Central Management Service) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP PowerDesigner (Proxy) version 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-44155",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44155"
},
{
"name": "CVE-2023-31407",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31407"
},
{
"name": "CVE-2023-30741",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30741"
},
{
"name": "CVE-2021-44152",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44152"
},
{
"name": "CVE-2022-41966",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41966"
},
{
"name": "CVE-2023-29188",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29188"
},
{
"name": "CVE-2023-29080",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29080"
},
{
"name": "CVE-2022-27667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27667"
},
{
"name": "CVE-2021-44151",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44151"
},
{
"name": "CVE-2023-30744",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30744"
},
{
"name": "CVE-2022-32244",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32244"
},
{
"name": "CVE-2023-30740",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30740"
},
{
"name": "CVE-2023-30743",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30743"
},
{
"name": "CVE-2021-44153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44153"
},
{
"name": "CVE-2022-39014",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39014"
},
{
"name": "CVE-2023-31404",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31404"
},
{
"name": "CVE-2023-30742",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30742"
},
{
"name": "CVE-2023-32113",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32113"
},
{
"name": "CVE-2023-28764",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28764"
},
{
"name": "CVE-2023-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29111"
},
{
"name": "CVE-2022-31596",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31596"
},
{
"name": "CVE-2023-31406",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31406"
},
{
"name": "CVE-2023-32112",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32112"
},
{
"name": "CVE-2023-32111",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32111"
},
{
"name": "CVE-2023-28762",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28762"
},
{
"name": "CVE-2021-44154",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44154"
}
],
"initial_release_date": "2023-05-10T00:00:00",
"last_revision_date": "2023-05-10T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0369",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-05-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP 2023-05-10 du 10 mai 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0301
Vulnerability from certfr_avis - Published: 2023-04-12 - Updated: 2023-04-12
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22,7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82,7.83, KERNEL 7.21, 7.22,7.49, 7.53, 7.73, 7.77, 7.81, 7.82 et 7.83 | ||
| SAP | N/A | SAP NetWeaver Process Integration version 7.50 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005 et 2011 | ||
| SAP | N/A | SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application versions 600 et 700 | ||
| SAP | N/A | SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791 | ||
| SAP | N/A | SAP Landscape Management version 3.0 | ||
| SAP | N/A | SAP Application Interface Framework (ODATA service) versions 755 et 756 | ||
| SAP | N/A | SAP NetWeaver AS for ABAP (Business Server Pages) versions 700, 701, 702, 731, 740,750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java for Deploy Service version 7.50 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | N/A | SAP Application Interface Framework (Log Message View of Message Dashboard) versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E | ||
| SAP | N/A | SAP CRM versions 700, 701, 702, 712 et 713 | ||
| SAP | N/A | SapSetup (Software Installation Program) version 9.0 | ||
| SAP | N/A | SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) version 720 | ||
| SAP | N/A | SAP HCM Fiori App My Forms (Fiori 2.0) version 605 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal version 7.50 | ||
| SAP | N/A | SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800 et 801 | ||
| SAP | N/A | SAP NetWeaver (BI CONT ADDON) versions 707, 737, 747 et 757 | ||
| SAP | N/A | SAP GUI for HTML versions KERNEL 7.22, 7.53, 7.547.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22 et 7.22EXT | ||
| SAP | N/A | SAP Application Interface Framework (Custom Hint of Message Dashboard Application versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E | ||
| SAP | N/A | SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791 | ||
| SAP | N/A | ABAP Platform and SAP Web Dispatcher versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89 et 7.91 | ||
| SAP | N/A | SAP Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22,7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82,7.83, KERNEL 7.21, 7.22,7.49, 7.53, 7.73, 7.77, 7.81, 7.82 et 7.83",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005 et 2011",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application versions 600 et 700",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Landscape Management version 3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (ODATA service) versions 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS for ABAP (Business Server Pages) versions 700, 701, 702, 731, 740,750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java for Deploy Service version 7.50",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (Log Message View of Message Dashboard) versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM versions 700, 701, 702, 712 et 713",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SapSetup (Software Installation Program) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) version 720",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP HCM Fiori App My Forms (Fiori 2.0) version 605",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal version 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800 et 801",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (BI CONT ADDON) versions 707, 737, 747 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI for HTML versions KERNEL 7.22, 7.53, 7.547.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22 et 7.22EXT",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (Custom Hint of Message Dashboard Application versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP Platform and SAP Web Dispatcher versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89 et 7.91",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-24527",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24527"
},
{
"name": "CVE-2023-29185",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29185"
},
{
"name": "CVE-2023-29189",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29189"
},
{
"name": "CVE-2023-29109",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29109"
},
{
"name": "CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"name": "CVE-2023-27897",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27897"
},
{
"name": "CVE-2023-29187",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29187"
},
{
"name": "CVE-2022-41272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
},
{
"name": "CVE-2023-24528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24528"
},
{
"name": "CVE-2023-26458",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26458"
},
{
"name": "CVE-2023-29186",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29186"
},
{
"name": "CVE-2021-33683",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33683"
},
{
"name": "CVE-2023-27267",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27267"
},
{
"name": "CVE-2023-28763",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28763"
},
{
"name": "CVE-2023-29110",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29110"
},
{
"name": "CVE-2023-27499",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27499"
},
{
"name": "CVE-2023-28761",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28761"
},
{
"name": "CVE-2023-27269",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27269"
},
{
"name": "CVE-2023-27497",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27497"
},
{
"name": "CVE-2023-1903",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1903"
},
{
"name": "CVE-2023-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29111"
},
{
"name": "CVE-2023-29108",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29108"
},
{
"name": "CVE-2023-28765",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28765"
},
{
"name": "CVE-2023-29112",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29112"
}
],
"initial_release_date": "2023-04-12T00:00:00",
"last_revision_date": "2023-04-12T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0301",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 11 avril 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2025-ALE-005
Vulnerability from certfr_alerte - Published: 2025-04-28 - Updated: 2025-06-24
Le 24 avril 2025, SAP a publié un bulletin de sécurité relatif à la vulnérabilité CVE-2025-31324 qui permet l'exécution de code arbitraire à distance pour un utilisateur non authentifié. Cette vulnérabilité est provoquée par un contournement de la politique de sécurité qui permet de télécharger des fichiers arbitraires et potentiellement exécutables sur le serveur. Elle impacte le composant Visual Composer development server, non installé par défaut mais fréquemment utilisé.
Le CERT-FR a connaissance de plusieurs compromissions liées à cette vulnérabilité.
L'accès aux détails complets concernant cette vulnérabilité ([1] [2]) nécessite un compte utilisateur pour le support SAP. Le bulletin de sécurité du 8 avril 2025 a été mis à jour pour indiquer cette nouvelle vulnérabilité sans faire mention de son exploitation active.
Identification du composant vulnérable
Il est possible de vérifier que le composant vulnérable Visual Composer development server est activé au travers de l'URL http://hote:port/nwa/sysinfo et de chercher la présence du composant VISUAL COMPOSER FRAMEWORK (VCFRAMEWORK.SCA ou VCFRAMEWORK). Si la ligne indique NO, le composant n'est pas installé.
Solutions
Avant d'appliquer le correctif de sécurité, il est nécessaire de vérifier qu'aucun fichier avec l'extension jsp, java ou class n'est présent dans les dossiers suivants :
* C:\usr\sap\<SID>\<InstanceID>\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
* C:\usr\sap\<SID>\<InstanceID>\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
* C:\usr\sap\<SID>\<InstanceID>\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work\sync
De plus, il est nécessaire de vérifier dans les journaux du serveur web :
* des accès à l'URL /developmentserver/metadatauploader via une requête POST avec un code HTTP 200 sans authentification ;
* des accès aux URL de la forme /irj/helper.jsp, /irj/cache.jsp ou /irj/\w{8}.jsp[3].
Enfin il est possible de consulter [4] pour d'autres indicateurs de compromission. Note : Ces indicateurs n'ont pas été qualifiés par le CERT-FR.
Si des fichiers malveillants ou des journaux suspects sont présents :
* signaler l’événement auprès du CERT-FR en mettant en copie vos éventuels CSIRTs métier et consulter les bons réflexes en cas d'intrusion sur votre système d'information [5] ;
* isoler totalement la machine concernée du réseau, vis-à-vis d'Internet comme du réseau interne, afin de limiter les risques de latéralisation ;
* en cas d'utilisation d'une appliance virtuelle, réaliser un instantané du système de fichier et de la mémoire vive ;
* si possible, éviter d'éteindre la machine afin de conserver les traces nécessaires aux investigations ;
* mettre sous séquestre les journaux collectés.
Les correctifs pour le composant Visual Composer Framework 7.50 sont listés et disponibles dans le bulletin de sécurité 3594142 de l'éditeur.
Des mesures de contournements sont proposées par l'éditeur [1].
Impacted products
References
| Title | Publication Time | Tags | |
|---|---|---|---|
|
|
|||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"closed_at": "2025-06-24",
"content": "## Identification du composant vuln\u00e9rable \n\nIl est possible de v\u00e9rifier que le composant vuln\u00e9rable Visual Composer development server est activ\u00e9 au travers de l\u0027URL `http://hote:port/nwa/sysinfo` et de chercher la pr\u00e9sence du composant `VISUAL COMPOSER FRAMEWORK` (`VCFRAMEWORK.SCA` ou `VCFRAMEWORK`). Si la ligne indique `NO`, le composant n\u0027est pas install\u00e9.\n\n## Solutions\n\nAvant d\u0027appliquer le correctif de s\u00e9curit\u00e9, il est n\u00e9cessaire de v\u00e9rifier qu\u0027aucun fichier avec l\u0027extension `jsp`, `java` ou `class` n\u0027est pr\u00e9sent dans les dossiers suivants :\n* `C:\\usr\\sap\\\u003cSID\u003e\\\u003cInstanceID\u003e\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\root`\n* `C:\\usr\\sap\\\u003cSID\u003e\\\u003cInstanceID\u003e\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\work`\n* `C:\\usr\\sap\\\u003cSID\u003e\\\u003cInstanceID\u003e\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\work\\sync`\n\nDe plus, il est n\u00e9cessaire de v\u00e9rifier dans les journaux du serveur web : \n* des acc\u00e8s \u00e0 l\u0027URL `/developmentserver/metadatauploader` via une requ\u00eate POST avec un code HTTP 200 sans authentification ;\n* des acc\u00e8s aux URL de la forme `/irj/helper.jsp`, `/irj/cache.jsp` ou `/irj/\\w{8}.jsp`[3].\n\nEnfin il est possible de consulter [4] pour d\u0027autres indicateurs de compromission. *Note : Ces indicateurs n\u0027ont pas \u00e9t\u00e9 qualifi\u00e9s par le CERT-FR.*\n\u003cbr\u003e\u003c/br\u003e\nSi des fichiers malveillants ou des journaux suspects sont pr\u00e9sents : \n* signaler l\u2019\u00e9v\u00e9nement aupr\u00e8s du CERT-FR en mettant en copie vos \u00e9ventuels CSIRTs m\u00e9tier et consulter les bons r\u00e9flexes en cas d\u0027intrusion sur votre syst\u00e8me d\u0027information [5] ;\n* isoler totalement la machine concern\u00e9e du r\u00e9seau, vis-\u00e0-vis d\u0027Internet comme du r\u00e9seau interne, afin de limiter les risques de lat\u00e9ralisation ;\n* en cas d\u0027utilisation d\u0027une appliance virtuelle, r\u00e9aliser un instantan\u00e9 du syst\u00e8me de fichier et de la m\u00e9moire vive ;\n* si possible, \u00e9viter d\u0027\u00e9teindre la machine afin de conserver les traces n\u00e9cessaires aux investigations ;\n* mettre sous s\u00e9questre les journaux collect\u00e9s.\n\nLes correctifs pour le composant Visual Composer Framework 7.50 sont list\u00e9s et disponibles dans le bulletin de s\u00e9curit\u00e9 3594142 de l\u0027\u00e9diteur. \n\nDes mesures de contournements sont propos\u00e9es par l\u0027\u00e9diteur [1]. ",
"cves": [
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
}
],
"initial_release_date": "2025-04-28T00:00:00",
"last_revision_date": "2025-06-24T00:00:00",
"links": [
{
"title": "Avis CERT-FR CERTFR-2025-AVI-0350 du 25 avril 2025",
"url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-0350/"
},
{
"title": "[4] Billet de blogue de Reliaquest relatif \u00e0 l\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2025-31324",
"url": "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
},
{
"title": "[5] Les bons r\u00e9flexes en cas d\u2019intrusion sur un syst\u00e8me d\u2019information",
"url": " https://www.cert.ssi.gouv.fr/les-bons-reflexes-en-cas-dintrusion-sur-un-systeme-dinformation/ "
},
{
"title": "[3] Billet de blogue Rapid7 du 28 avril relatif \u00e0 la vuln\u00e9rabilit\u00e9 CVE-2025-31324",
"url": "https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/"
},
{
"title": "[1] Bulletin de s\u00e9curit\u00e9 SAP 3593336 version 5 du 28/04/2025 relatif aux mesures de contournement",
"url": "https://me.sap.com/notes/3593336"
},
{
"title": "[2] FAQ sur l\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2025-31324",
"url": " https://me.sap.com/notes/3596125"
}
],
"reference": "CERTFR-2025-ALE-005",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-28T00:00:00.000000"
},
{
"description": " Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
"revision_date": "2025-06-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Le 24 avril 2025, SAP a publi\u00e9 un bulletin de s\u00e9curit\u00e9 relatif \u00e0 la vuln\u00e9rabilit\u00e9 CVE-2025-31324 qui permet l\u0027ex\u00e9cution de code arbitraire \u00e0 distance pour un utilisateur non authentifi\u00e9. Cette vuln\u00e9rabilit\u00e9 est provoqu\u00e9e par un contournement de la politique de s\u00e9curit\u00e9 qui permet de t\u00e9l\u00e9charger des fichiers arbitraires et potentiellement ex\u00e9cutables sur le serveur. Elle impacte le composant *Visual Composer development server*, non install\u00e9 par d\u00e9faut mais fr\u00e9quemment utilis\u00e9.\n\nLe CERT-FR a connaissance de plusieurs compromissions li\u00e9es \u00e0 cette vuln\u00e9rabilit\u00e9. \n\n\nL\u0027acc\u00e8s aux d\u00e9tails complets concernant cette vuln\u00e9rabilit\u00e9 ([1] [2]) n\u00e9cessite un compte utilisateur pour le support SAP. Le bulletin de s\u00e9curit\u00e9 du 8 avril 2025 a \u00e9t\u00e9 mis \u00e0 jour pour indiquer cette nouvelle vuln\u00e9rabilit\u00e9 sans faire mention de son exploitation active.",
"title": "Vuln\u00e9rabilit\u00e9 dans SAP NetWeaver",
"vendor_advisories": [
{
"published_at": "2025-04-24",
"title": "Bulletin de s\u00e9curit\u00e9 SAP april-2025",
"url": " https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html "
},
{
"published_at": "2025-04-24",
"title": "Bulletin de s\u00e9curit\u00e9 SAP 3594142 version 17",
"url": "https://me.sap.com/notes/3594142"
}
]
}
CVE-2023-29189 (GCVE-0-2023-29189)
Vulnerability from cvelistv5 – Published: 2023-04-11 03:11 – Updated: 2025-02-07 19:31
VLAI
EPSS
VEX
Title
HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)
Summary
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-07 19:31 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
sap
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SAP | CRM (WebClient UI) |
Affected:
S4FND 102
Affected: S4FND 103 Affected: S4FND 104 Affected: S4FND 105 Affected: S4FND 106 Affected: S4FND 107 Affected: WEBCUIF 700 Affected: WEBCUIF 701 Affected: WEBCUIF 731 Affected: WEBCUIF 730 Affected: WEBCUIF 746 Affected: WEBCUIF 747 Affected: WEBCUIF 748 Affected: WEBCUIF 800 Affected: WEBCUIF 801 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:00:15.877Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/3269352"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29189",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T19:31:40.763545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-07T19:31:46.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CRM (WebClient UI)",
"vendor": "SAP",
"versions": [
{
"status": "affected",
"version": "S4FND 102"
},
{
"status": "affected",
"version": "S4FND 103"
},
{
"status": "affected",
"version": "S4FND 104"
},
{
"status": "affected",
"version": "S4FND 105"
},
{
"status": "affected",
"version": "S4FND 106"
},
{
"status": "affected",
"version": "S4FND 107"
},
{
"status": "affected",
"version": "WEBCUIF 700"
},
{
"status": "affected",
"version": "WEBCUIF 701"
},
{
"status": "affected",
"version": "WEBCUIF 731"
},
{
"status": "affected",
"version": "WEBCUIF 730"
},
{
"status": "affected",
"version": "WEBCUIF 746"
},
{
"status": "affected",
"version": "WEBCUIF 747"
},
{
"status": "affected",
"version": "WEBCUIF 748"
},
{
"status": "affected",
"version": "WEBCUIF 800"
},
{
"status": "affected",
"version": "WEBCUIF 801"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields\u003c/p\u003e"
}
],
"value": "SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T20:16:30.045Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://launchpad.support.sap.com/#/notes/3269352"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2023-29189",
"datePublished": "2023-04-11T03:11:30.554Z",
"dateReserved": "2023-04-03T09:22:43.158Z",
"dateUpdated": "2025-02-07T19:31:46.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29187 (GCVE-0-2023-29187)
Vulnerability from cvelistv5 – Published: 2023-04-11 03:09 – Updated: 2025-02-26 19:07
VLAI
EPSS
VEX
Title
DLL Hijacking vulnerability in SapSetup (Software Installation Program)
Summary
A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-12 19:22 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
sap
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SAP | SapSetup (Software Installation Program) |
Affected:
9.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:00:15.993Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/3311624"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29187",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-12T19:22:43.431196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T19:07:54.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SapSetup (Software Installation Program)",
"vendor": "SAP",
"versions": [
{
"status": "affected",
"version": "9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.\u003c/p\u003e"
}
],
"value": "A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T03:09:31.468Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://launchpad.support.sap.com/#/notes/3311624"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DLL Hijacking vulnerability in SapSetup (Software Installation Program)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2023-29187",
"datePublished": "2023-04-11T03:09:31.468Z",
"dateReserved": "2023-04-03T09:22:43.158Z",
"dateUpdated": "2025-02-26T19:07:54.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29186 (GCVE-0-2023-29186)
Vulnerability from cvelistv5 – Published: 2023-04-11 03:08 – Updated: 2025-02-07 17:12
VLAI
EPSS
VEX
Title
Directory/Path Traversal vulnerability in SAP NetWeaver.
Summary
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-07 17:12 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
sap
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SAP | NetWeaver (BI CONT ADDON) |
Affected:
707
Affected: 737 Affected: 747 Affected: 757 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:00:15.983Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/3305907"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29186",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T17:12:06.654012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-07T17:12:10.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetWeaver (BI CONT ADDON)",
"vendor": "SAP",
"versions": [
{
"status": "affected",
"version": "707"
},
{
"status": "affected",
"version": "737"
},
{
"status": "affected",
"version": "747"
},
{
"status": "affected",
"version": "757"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to\u00a0upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.\u003c/p\u003e"
}
],
"value": "In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to\u00a0upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T20:17:30.169Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://launchpad.support.sap.com/#/notes/3305907"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Directory/Path Traversal vulnerability in SAP NetWeaver.",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2023-29186",
"datePublished": "2023-04-11T03:08:49.584Z",
"dateReserved": "2023-04-03T09:22:43.157Z",
"dateUpdated": "2025-02-07T17:12:10.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29185 (GCVE-0-2023-29185)
Vulnerability from cvelistv5 – Published: 2023-04-11 03:08 – Updated: 2025-02-07 17:12
VLAI
EPSS
VEX
Title
Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)
Summary
SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-07 17:12 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
sap
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SAP | NetWeaver AS for ABAP (Business Server Pages) |
Affected:
700
Affected: 701 Affected: 702 Affected: 731 Affected: 740 Affected: 750 Affected: 751 Affected: 752 Affected: 753 Affected: 754 Affected: 755 Affected: 756 Affected: 757 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:00:15.869Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/3303060"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T17:12:25.143854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-07T17:12:28.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetWeaver AS for ABAP (Business Server Pages)",
"vendor": "SAP",
"versions": [
{
"status": "affected",
"version": "700"
},
{
"status": "affected",
"version": "701"
},
{
"status": "affected",
"version": "702"
},
{
"status": "affected",
"version": "731"
},
{
"status": "affected",
"version": "740"
},
{
"status": "affected",
"version": "750"
},
{
"status": "affected",
"version": "751"
},
{
"status": "affected",
"version": "752"
},
{
"status": "affected",
"version": "753"
},
{
"status": "affected",
"version": "754"
},
{
"status": "affected",
"version": "755"
},
{
"status": "affected",
"version": "756"
},
{
"status": "affected",
"version": "757"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server\u0027s resources sufficiently to make it unavailable over the network without any user interaction.\u003c/p\u003e"
}
],
"value": "SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server\u0027s resources sufficiently to make it unavailable over the network without any user interaction.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T20:17:17.240Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://launchpad.support.sap.com/#/notes/3303060"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2023-29185",
"datePublished": "2023-04-11T03:08:03.125Z",
"dateReserved": "2023-04-03T09:22:43.157Z",
"dateUpdated": "2025-02-07T17:12:28.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}