Search criteria
79 vulnerabilities found for N/A by SAP
CERTFR-2025-AVI-0764
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Business One (SLD) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Planning and Consolidation versions BPC4HANA 200, 300, SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et CPMBPC 810 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud and Datahub versions HY_COM 2205, HY_DHUB 2205, COM_CLOUD 2211 et DHUB_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori (Launchpad) version SAP_UI 754 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori App (F4044 Manage Work Center Groups) versions UIS4HOP1 600, 700, 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori app (Manage Payment Blocks) versions S4CORE 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | HCM (Approve Timesheets Fiori 2.0 application) version GBX01HR5 605 sans le dernier correctif de sécurité | ||
| SAP | N/A | HCM (My Timesheet Fiori 2.0 application) version GBX01HR5 605 sans le dernier correctif de sécurité | ||
| SAP | N/A | Landscape Transformation Replication Server versions DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752 et 2020 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver (Service Data Download) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver ABAP Platform versions S4CRM 100, 200, 204, 205, 206, S4CEXT 109, BBPCRM 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java (Adobe Document Service) version ADSSAP 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java (Deploy Web Service) version J2EE-APPS 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server Java version WD-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP (Background Processing) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver and ABAP Platform (Service Data Collection) versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53 et 7.54 sans le dernier correctif de sécurité | ||
| SAP | N/A | Netweaver (RMI-P4) version SERVERCORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA (Private Cloud or On-Premise) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | Supplier Relationship Management versions RM_SERVER 700, 701, 702, 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java (IIOP Service) version SERVERCORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Business One (SLD) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Planning and Consolidation versions BPC4HANA 200, 300, SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et CPMBPC 810 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud and Datahub versions HY_COM 2205, HY_DHUB 2205, COM_CLOUD 2211 et DHUB_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori (Launchpad) version SAP_UI 754 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori App (F4044 Manage Work Center Groups) versions UIS4HOP1 600, 700, 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori app (Manage Payment Blocks) versions S4CORE 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HCM (Approve Timesheets Fiori 2.0 application) version GBX01HR5 605 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HCM (My Timesheet Fiori 2.0 application) version GBX01HR5 605 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation Replication Server versions DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752 et 2020 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Service Data Download) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Platform versions S4CRM 100, 200, 204, 205, 206, S4CEXT 109, BBPCRM 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (Adobe Document Service) version ADSSAP 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (Deploy Web Service) version J2EE-APPS 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version WD-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP (Background Processing) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver and ABAP Platform (Service Data Collection) versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53 et 7.54 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Netweaver (RMI-P4) version SERVERCORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud or On-Premise) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management versions RM_SERVER 700, 701, 702, 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (IIOP Service) version SERVERCORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42911"
},
{
"name": "CVE-2025-42938",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42938"
},
{
"name": "CVE-2025-42958",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42958"
},
{
"name": "CVE-2025-42944",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42944"
},
{
"name": "CVE-2025-27428",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27428"
},
{
"name": "CVE-2025-22228",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22228"
},
{
"name": "CVE-2025-42916",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42916"
},
{
"name": "CVE-2025-42914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42914"
},
{
"name": "CVE-2025-42961",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42961"
},
{
"name": "CVE-2025-42922",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42922"
},
{
"name": "CVE-2024-13009",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-13009"
},
{
"name": "CVE-2023-5072",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5072"
},
{
"name": "CVE-2025-42929",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42929"
},
{
"name": "CVE-2025-42920",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42920"
},
{
"name": "CVE-2025-42930",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42930"
},
{
"name": "CVE-2025-42913",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42913"
},
{
"name": "CVE-2025-42915",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42915"
},
{
"name": "CVE-2025-42918",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42918"
},
{
"name": "CVE-2025-42923",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42923"
},
{
"name": "CVE-2025-42926",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42926"
},
{
"name": "CVE-2025-42933",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42933"
},
{
"name": "CVE-2025-42917",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42917"
},
{
"name": "CVE-2025-42912",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42912"
},
{
"name": "CVE-2023-27500",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27500"
},
{
"name": "CVE-2025-42925",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42925"
},
{
"name": "CVE-2025-42927",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42927"
},
{
"name": "CVE-2025-42941",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42941"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0764",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-09-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 SAP september-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2025.html"
}
]
}
CERTFR-2025-AVI-0564
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver | NetWeaver et ABAP Platform (SDCCN) versions ST-PI 2008_1_700, 2008_1_710 et 740 | ||
| SAP | NetWeaver | NetWeaver Application Server ABAP and ABAP Platform versionsAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027 | ||
| SAP | NetWeaver | NetWeaver Application Server Java version ENGINEAPI 7.50 | ||
| SAP | NetWeaver | NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | Business Warehouse | Business Warehouse and SAP BW/4HANA BEx Tools version DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | NetWeaver | NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50 | ||
| SAP | Business Objects Business Intelligence Platform | Business Objects Business Intelligence Platform (CMC) versions ENTERPRISE 430 et 2025 | ||
| SAP | NetWeaver | NetWeaver Enterprise Portal Federated Portal Network version EP-RUNTIME 7.50 | ||
| SAP | NetWeaver | NetWeaver (RFC enabled function module) versions SAP_BW 700, 701, 702, 710, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et 916 | ||
| SAP | NetWeaver | NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA and SAP SCM (Characteristic Propagation) versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, SCM 700, 701, 702 et 712 | ||
| SAP | N/A | SAPCAR versions SAP_CAR 7.53 et 7.22EXT | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758 | ||
| SAP | NetWeaver | NetWeaver ABAP Server and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914 et SAP_BASIS 915 | ||
| SAP | NetWeaver | NetWeaver et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753 et SAP_BASIS 754 | ||
| SAP | NetWeaver | NetWeaver Application Server for Java (Log Viewer) version LMNWABASICAPPS 7.50 | ||
| SAP | NetWeaver | NetWeaver (XML Data Archiving Service) version J2EE-APPS 7.50 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Content Administrator workbench versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | N/A | Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | N/A | Data Services (DQ Report) versions SBOP_DS_MANAGEMENT_CONSOLE 4.3 et 2025 | ||
| SAP | NetWeaver | NetWeaver Visual Composer version VCBASE 7.50 | ||
| SAP | NetWeaver | NetWeaver Business Warehouse (CCAW application) versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | N/A | Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14 | ||
| SAP | Business Warehouse | Business Warehouse (Business Explorer Web 3.5 loading animation) versions DW4CORE 100, 200, 300, 400, 916, SAP_BW 730, 731, 740, 750, 751, 752, 753, 754, 756, 757 et 758 | ||
| SAP | NetWeaver | NetWeaver Application Server for ABAP versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects BI Platform Central Management Console Promotion Management Application versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | Business Warehouse | Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver et ABAP Platform (SDCCN) versions ST-PI 2008_1_700, 2008_1_710 et 740",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versionsAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version ENGINEAPI 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse and SAP BW/4HANA BEx Tools version DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (CMC) versions ENTERPRISE 430 et 2025",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal Federated Portal Network version EP-RUNTIME 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (RFC enabled function module) versions SAP_BW 700, 701, 702, 710, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et 916",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA and SAP SCM (Characteristic Propagation) versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, SCM 700, 701, 702 et 712",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPCAR versions SAP_CAR 7.53 et 7.22EXT",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Server and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914 et SAP_BASIS 915",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753 et SAP_BASIS 754",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for Java (Log Viewer) version LMNWABASICAPPS 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (XML Data Archiving Service) version J2EE-APPS 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Content Administrator workbench versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Services (DQ Report) versions SBOP_DS_MANAGEMENT_CONSOLE 4.3 et 2025",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Visual Composer version VCBASE 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Business Warehouse (CCAW application) versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse (Business Explorer Web 3.5 loading animation) versions DW4CORE 100, 200, 300, 400, 916, SAP_BW 730, 731, 740, 750, 751, 752, 753, 754, 756, 757 et 758",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects BI Platform Central Management Console Promotion Management Application versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42985"
},
{
"name": "CVE-2025-42968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42968"
},
{
"name": "CVE-2025-42971",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42971"
},
{
"name": "CVE-2025-42954",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42954"
},
{
"name": "CVE-2025-42970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42970"
},
{
"name": "CVE-2025-42953",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42953"
},
{
"name": "CVE-2025-31326",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31326"
},
{
"name": "CVE-2025-42961",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42961"
},
{
"name": "CVE-2025-42974",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42974"
},
{
"name": "CVE-2025-42978",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42978"
},
{
"name": "CVE-2025-30012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30012"
},
{
"name": "CVE-2025-42952",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42952"
},
{
"name": "CVE-2025-42981",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42981"
},
{
"name": "CVE-2025-42979",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42979"
},
{
"name": "CVE-2025-42993",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42993"
},
{
"name": "CVE-2025-42959",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42959"
},
{
"name": "CVE-2025-42963",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42963"
},
{
"name": "CVE-2025-42969",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42969"
},
{
"name": "CVE-2025-42977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42977"
},
{
"name": "CVE-2025-42986",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42986"
},
{
"name": "CVE-2025-42966",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42966"
},
{
"name": "CVE-2025-30009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30009"
},
{
"name": "CVE-2025-30011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30011"
},
{
"name": "CVE-2025-42962",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42962"
},
{
"name": "CVE-2025-42956",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42956"
},
{
"name": "CVE-2025-43001",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43001"
},
{
"name": "CVE-2024-53677",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53677"
},
{
"name": "CVE-2025-30010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30010"
},
{
"name": "CVE-2025-42997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42997"
},
{
"name": "CVE-2025-42965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42965"
},
{
"name": "CVE-2025-30018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30018"
},
{
"name": "CVE-2025-42967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42967"
},
{
"name": "CVE-2025-42980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42980"
},
{
"name": "CVE-2025-42964",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42964"
},
{
"name": "CVE-2025-42992",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42992"
},
{
"name": "CVE-2025-42973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42973"
},
{
"name": "CVE-2025-42960",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42960"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0564",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-07-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP july-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html"
}
]
}
CERTFR-2025-AVI-0396
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA | S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102 | ||
| SAP | NetWeaver | NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50 | ||
| SAP | N/A | Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025 | ||
| SAP | N/A | Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | N/A | Data Services Management Console version SBOP DS JOB SERVER 4.3 | ||
| SAP | N/A | Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0 | ||
| SAP | N/A | Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | S/4HANA | S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106 | ||
| SAP | S/4HANA | S/4HANA (Private Cloud & On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714 | ||
| SAP | S/4HANA | S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714 | ||
| SAP | N/A | Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | N/A | Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103 | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 | ||
| SAP | N/A | Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | N/A | GUI for Windows version BC-FES-GUI 8.00 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Services Management Console version SBOP DS JOB SERVER 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud \u0026 On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI for Windows version BC-FES-GUI 8.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43003",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43003"
},
{
"name": "CVE-2025-43007",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43007"
},
{
"name": "CVE-2025-23191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23191"
},
{
"name": "CVE-2025-42999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42999"
},
{
"name": "CVE-2025-43009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43009"
},
{
"name": "CVE-2025-43011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43011"
},
{
"name": "CVE-2025-43006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43006"
},
{
"name": "CVE-2025-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0060"
},
{
"name": "CVE-2025-30012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30012"
},
{
"name": "CVE-2025-43000",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43000"
},
{
"name": "CVE-2025-43004",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43004"
},
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
},
{
"name": "CVE-2025-43005",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43005"
},
{
"name": "CVE-2025-43008",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43008"
},
{
"name": "CVE-2025-31329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31329"
},
{
"name": "CVE-2025-30009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30009"
},
{
"name": "CVE-2025-30011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30011"
},
{
"name": "CVE-2025-43002",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43002"
},
{
"name": "CVE-2025-26662",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26662"
},
{
"name": "CVE-2025-30010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30010"
},
{
"name": "CVE-2025-42997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42997"
},
{
"name": "CVE-2025-0061",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0061"
},
{
"name": "CVE-2025-43010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43010"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2025-30018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30018"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0396",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-13T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE CVE-2025-0060, CVE-2025-0061 et CVE-2025-23191",
"revision_date": "2025-06-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-05-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP may-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html"
}
]
}
CERTFR-2025-AVI-0350
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans SAP NetWeaver. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur indique que la vulnérabilité CVE-2025-31324 est activement exploitée.
Cette information est disponible sur la foire aux questions relative à cette vulnérabilité [1]. L'accès à ce lien nécessite un compte utilisateur pour le support SAP.
Cette vulnérabilité, ajoutée au bulletin de sécurité SAP du 08 avril 2025, nécessite un correctif disponible depuis le 22 avril 2025. La mise à jour du 08 avril 2025 ne semble donc pas couvrir cette vulnérabilité.
Impacted products
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur indique que la vuln\u00e9rabilit\u00e9 CVE-2025-31324 est activement exploit\u00e9e. \n\nCette information est disponible sur la foire aux questions relative \u00e0 cette vuln\u00e9rabilit\u00e9 [1]. L\u0027acc\u00e8s \u00e0 ce lien n\u00e9cessite un compte utilisateur pour le support SAP. \n\nCette vuln\u00e9rabilit\u00e9, ajout\u00e9e au bulletin de s\u00e9curit\u00e9 SAP du 08 avril 2025, n\u00e9cessite un correctif disponible depuis le 22 avril 2025. La mise \u00e0 jour du 08 avril 2025 ne semble donc pas couvrir cette vuln\u00e9rabilit\u00e9.",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
}
],
"links": [
{
"title": "[1] FAQ sur l\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2025-31324",
"url": "https://me.sap.com/notes/3596125"
},
{
"title": "Avis CERTFR-2025-AVI-0285 du 08 avril 2025",
"url": "https://cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-0285/"
}
],
"reference": "CERTFR-2025-AVI-0350",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-25T00:00:00.000000"
},
{
"description": "Correction dune r\u00e9p\u00e9tition dans la source.",
"revision_date": "2025-05-19T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SAP NetWeaver. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans SAP NetWeaver",
"vendor_advisories": [
{
"published_at": "2025-04-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP april-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html"
}
]
}
CERTFR-2025-AVI-0285
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur indique que la vulnérabilité CVE-2025-31324 est activement exploitée.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA (Private Cloud) | S/4HANA (Learning Solution) versions S4HCMGXX 100 et 101 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 et 9.14 sans le dernier correctif de sécurité | ||
| SAP | SAP BusinessObjects Business Intelligence | BusinessObjects Business Intelligence platform (Central Management Console) versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server ABAP (Virus Scan Interface) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver et ABAP Platform (Service Data Collection) versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de sécurité | ||
| SAP | S4CORE entity | S4CORE entity versions S4CORE 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | ERP BW Business Content | ERP BW Business Content versions BI_CONT 707, 737, 747 et 757 sans le dernier correctif de sécurité | ||
| SAP | Commerce Cloud | Commerce Cloud (Public Cloud) version COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Field Logistics versions S4CORE 107 et 108 sans le dernier correctif | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver et ABAP | NetWeaver et ABAP Platform (Application Server ABAP) versions KRNL64UC 7.53, KERNEL 7.53 et 7.54 sans le dernier correctif de sécurité | ||
| SAP | Solution Manager | Solution Manager versions ST 720, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | Capital Yield Tax Management | Capital Yield Tax Management versions CYTERP 420_700, CYT 800, IBS 7.0 et CYT4HANA 100 sans le dernier correctif de sécurité | ||
| SAP | SAP BusinessObjects Business Intelligence | BusinessObjects Business Intelligence Platform version ENTERPRISE 430 sans le dernier correctif de sécurité | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA (Private Cloud) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | CRM | CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité | ||
| SAP | KMC WPC | KMC WPC version KMC-WPC 7.50 sans le dernier correctif de sécurité | ||
| SAP | Landscape Transformation | Landscape Transformation (Analysis Platform) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730 et 2011_1_731 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA (Learning Solution) versions S4HCMGXX 100 et 101 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence platform (Central Management Console) versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (Virus Scan Interface) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et ABAP Platform (Service Data Collection) versions ST-PI 2008_1_700, 2008_1_710 et 740 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver versions SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H et 75I sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4CORE entity versions S4CORE 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S4CORE entity",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ERP BW Business Content versions BI_CONT 707, 737, 747 et 757 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "ERP BW Business Content",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud (Public Cloud) version COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9\n",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Field Logistics versions S4CORE 107 et 108 sans le dernier correctif",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et ABAP Platform (Application Server ABAP) versions KRNL64UC 7.53, KERNEL 7.53 et 7.54 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver et ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Manager versions ST 720, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Solution Manager",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Capital Yield Tax Management versions CYTERP 420_700, CYT 800, IBS 7.0 et CYT4HANA 100 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Capital Yield Tax Management",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform version ENTERPRISE 430 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud) versions S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "CRM",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "KMC WPC version KMC-WPC 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "KMC WPC",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation (Analysis Platform) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730 et 2011_1_731 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Landscape Transformation",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur indique que la vuln\u00e9rabilit\u00e9 CVE-2025-31324 est activement exploit\u00e9e.",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-30015",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30015"
},
{
"name": "CVE-2025-31333",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31333"
},
{
"name": "CVE-2025-27429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27429"
},
{
"name": "CVE-2025-27428",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27428"
},
{
"name": "CVE-2025-0064",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0064"
},
{
"name": "CVE-2025-23186",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23186"
},
{
"name": "CVE-2025-27435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27435"
},
{
"name": "CVE-2025-26654",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26654"
},
{
"name": "CVE-2025-26653",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26653"
},
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
},
{
"name": "CVE-2025-30014",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30014"
},
{
"name": "CVE-2024-56337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56337"
},
{
"name": "CVE-2025-27437",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27437"
},
{
"name": "CVE-2025-30016",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30016"
},
{
"name": "CVE-2025-31332",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31332"
},
{
"name": "CVE-2025-26657",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26657"
},
{
"name": "CVE-2025-31328",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31328"
},
{
"name": "CVE-2025-30013",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30013"
},
{
"name": "CVE-2025-30017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30017"
},
{
"name": "CVE-2025-27430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27430"
},
{
"name": "CVE-2025-31331",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31331"
},
{
"name": "CVE-2025-31330",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31330"
},
{
"name": "CVE-2025-31327",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31327"
}
],
"links": [
{
"title": "FAQ sur l\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2025-31324",
"url": "https://me.sap.com/notes/3596125"
}
],
"reference": "CERTFR-2025-AVI-0285",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-08T00:00:00.000000"
},
{
"description": "Ajout des vuln\u00e9rabilit\u00e9s CVE-2025-31324, CVE-2025-31328 et CVE-2025-31327",
"revision_date": "2025-04-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-04-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP april-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html"
}
]
}
CERTFR-2025-AVI-0190
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Electronic Invoicing for Brazil (eDocument Cockpit) versions SAP_APPL 617, 618, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | Just In Time versions S4CORE 102, 103, 104, 105, 106, 107, 108 et ECC-DIMP 618 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025,2027, ENTERPRISECLIENTTOOLS 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud et Datahub, versions Y_COM 2205, HY_DHUB 2205, COM_CLOUD 2211 et DHUB_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions Y-COM 2205 et COM-CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver (ABAP Class Builder) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | N/A | Web Dispatcher et Internet Communication Manager versions KRNL64UC 7.53, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.89, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Enterprise Portal (OBN component) version EP-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business One (Service Layer) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori apps (Posting Library) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server Java version AJAX-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Objects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse (Process Chains) versions DW4CORE 100, DW4CORE 200, DW4CORE 300, DW4CORE 400, DW4CORE 914, SAP_BW 730, SAP_BW 731, SAP_BW 740 et SAP_BW 750 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA (RBD) versions S4CORE 102, 103, 104, 105, 106, 107, 108, EA-FINSERV 618 et EA-FINSERV 800 sans le dernier correctif de sécurité | ||
| SAP | N/A | Bibliothèque @sap/approuter versions antérieures à 16.7.1 | ||
| SAP | N/A | Commerce (Swagger UI) version COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA (Manage Bank Statements) versions S4CORE 107 et S4CORE 108 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Electronic Invoicing for Brazil (eDocument Cockpit) versions SAP_APPL 617, 618, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Just In Time versions S4CORE 102, 103, 104, 105, 106, 107, 108 et ECC-DIMP 618 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025,2027, ENTERPRISECLIENTTOOLS 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud et Datahub, versions Y_COM 2205, HY_DHUB 2205, COM_CLOUD 2211 et DHUB_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions Y-COM 2205 et COM-CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (ABAP Class Builder) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher et Internet Communication Manager versions KRNL64UC 7.53, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.89, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal (OBN component) version EP-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One (Service Layer) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori apps (Posting Library) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version AJAX-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse (Process Chains) versions DW4CORE 100, DW4CORE 200, DW4CORE 300, DW4CORE 400, DW4CORE 914, SAP_BW 730, SAP_BW 731, SAP_BW 740 et SAP_BW 750 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (RBD) versions S4CORE 102, 103, 104, 105, 106, 107, 108, EA-FINSERV 618 et EA-FINSERV 800 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Biblioth\u00e8que @sap/approuter versions ant\u00e9rieures \u00e0 16.7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce (Swagger UI) version COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Manage Bank Statements) versions S4CORE 107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-26661",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26661"
},
{
"name": "CVE-2025-27433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27433"
},
{
"name": "CVE-2024-38286",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38286"
},
{
"name": "CVE-2025-25245",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25245"
},
{
"name": "CVE-2024-38819",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38819"
},
{
"name": "CVE-2025-23194",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23194"
},
{
"name": "CVE-2025-26660",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26660"
},
{
"name": "CVE-2025-25244",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25244"
},
{
"name": "CVE-2024-38820",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38820"
},
{
"name": "CVE-2025-26658",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26658"
},
{
"name": "CVE-2025-24876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24876"
},
{
"name": "CVE-2025-23188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23188"
},
{
"name": "CVE-2025-27434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27434"
},
{
"name": "CVE-2025-0062",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0062"
},
{
"name": "CVE-2025-26659",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26659"
},
{
"name": "CVE-2024-41736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41736"
},
{
"name": "CVE-2025-27432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27432"
},
{
"name": "CVE-2025-26656",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26656"
},
{
"name": "CVE-2025-23185",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23185"
},
{
"name": "CVE-2025-25242",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25242"
},
{
"name": "CVE-2025-27430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27430"
},
{
"name": "CVE-2025-27431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27431"
},
{
"name": "CVE-2025-26655",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26655"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2025-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0071"
},
{
"name": "CVE-2025-27436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27436"
},
{
"name": "CVE-2024-52316",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52316"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0190",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-03-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 SAP march-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html"
}
]
}
CERTFR-2025-AVI-0114
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | HANA extended application services, advanced model (User Account and Authentication Services) version SAP_EXTENDED_APP_SERVICES 1 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori for ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Platform (BI Launchpad) versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver and ABAP platform (ST-PI) versions ST-PI 2008_1_700, ST-PI 2008_1_710 et ST-PI 740 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server Java version WD-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori Apps Reference Library (My Overtime Requests) version GBX01HR5 605 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce (Backoffice) versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence platform (Central Management Console) versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server Java versions EP-BASIS 7.50 et FRAMEWORK-EXT 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver and ABAP Platform (SDCCN) versions ST-PI 2008_1_700, ST-PI 2008_1_710 et ST-PI 740 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java for Deploy Service versions ENGINEAPI 7.50 et SERVERCORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | GUI for Windows version BC-FES-GUI 8.00 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enterprise Project Connection version 3.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | ABAP Platform (ABAP Build Framework) versions SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java (User Admin Application) version 7.50 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "HANA extended application services, advanced model (User Account and Authentication Services) version SAP_EXTENDED_APP_SERVICES 1 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori for ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Platform (BI Launchpad) versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver and ABAP platform (ST-PI) versions ST-PI 2008_1_700, ST-PI 2008_1_710 et ST-PI 740 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version WD-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori Apps Reference Library (My Overtime Requests) version GBX01HR5 605 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce (Backoffice) versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence platform (Central Management Console) versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java versions EP-BASIS 7.50 et FRAMEWORK-EXT 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver and ABAP Platform (SDCCN) versions ST-PI 2008_1_700, ST-PI 2008_1_710 et ST-PI 740 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java for Deploy Service versions ENGINEAPI 7.50 et SERVERCORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI for Windows version BC-FES-GUI 8.00 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enterprise Project Connection version 3.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP Platform (ABAP Build Framework) versions SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (User Admin Application) version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-24874",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24874"
},
{
"name": "CVE-2025-24875",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24875"
},
{
"name": "CVE-2025-23191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23191"
},
{
"name": "CVE-2023-24527",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24527"
},
{
"name": "CVE-2025-0064",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0064"
},
{
"name": "CVE-2024-38819",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38819"
},
{
"name": "CVE-2024-38820",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38820"
},
{
"name": "CVE-2025-23189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23189"
},
{
"name": "CVE-2025-23193",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23193"
},
{
"name": "CVE-2025-23187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23187"
},
{
"name": "CVE-2025-24870",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24870"
},
{
"name": "CVE-2025-25241",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25241"
},
{
"name": "CVE-2024-45216",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45216"
},
{
"name": "CVE-2025-24876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24876"
},
{
"name": "CVE-2025-23190",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23190"
},
{
"name": "CVE-2024-22126",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22126"
},
{
"name": "CVE-2025-25243",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25243"
},
{
"name": "CVE-2024-45217",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45217"
},
{
"name": "CVE-2025-0054",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0054"
},
{
"name": "CVE-2024-38828",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38828"
},
{
"name": "CVE-2025-24867",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24867"
},
{
"name": "CVE-2025-24868",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24868"
},
{
"name": "CVE-2025-24869",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24869"
},
{
"name": "CVE-2025-24872",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24872"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0114",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-02-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-02-10",
"title": "Bulletin de s\u00e9curit\u00e9 SAP february-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2025.html"
}
]
}
CERTFR-2025-AVI-0027
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | GUI pour Java version BC-FES-JAV 7.80 sans le dernier correctif de sécurité | ||
| SAP | N/A | GUI pour Windows version BC-FES-GUI 8.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS pour ABAP et ABAP Platform (Internet Communication Framework) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 912, SAP_BASIS 913 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | N/A | SAPSetup version LMSAPSETUP 9.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server pour ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756 et SAP_BASIS 757 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP (applications basé sur GUI pour HTML) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server Java version WD-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server pour ABAP et ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 7.97, 8.04, 9.12, 9.13 et 9.14 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS JAVA (User Admin Application) versions ENGINEAPI 7.50, SERVERCORE 7.50 et UMEADMIN 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Workflow et Flexible Workflow versions SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 912, SAP_BASIS 913 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform (Crystal Reports pour Enterprise) version ENTERPRISE 430 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "GUI pour Java version BC-FES-JAV 7.80 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI pour Windows version BC-FES-GUI 8.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS pour ABAP et ABAP Platform (Internet Communication Framework) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 912, SAP_BASIS 913 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPSetup version LMSAPSETUP 9.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756 et SAP_BASIS 757 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (applications bas\u00e9 sur GUI pour HTML) versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version WD-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP et ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 7.97, 8.04, 9.12, 9.13 et 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS JAVA (User Admin Application) versions ENGINEAPI 7.50, SERVERCORE 7.50 et UMEADMIN 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Workflow et Flexible Workflow versions SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 912, SAP_BASIS 913 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Crystal Reports pour Enterprise) version ENTERPRISE 430 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-0055",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0055"
},
{
"name": "CVE-2025-0057",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0057"
},
{
"name": "CVE-2025-0056",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0056"
},
{
"name": "CVE-2025-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0060"
},
{
"name": "CVE-2025-0058",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0058"
},
{
"name": "CVE-2024-29131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29131"
},
{
"name": "CVE-2025-0068",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0068"
},
{
"name": "CVE-2025-0053",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0053"
},
{
"name": "CVE-2025-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0059"
},
{
"name": "CVE-2025-0069",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0069"
},
{
"name": "CVE-2024-29133",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29133"
},
{
"name": "CVE-2025-0070",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0070"
},
{
"name": "CVE-2025-0066",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0066"
},
{
"name": "CVE-2025-0061",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0061"
},
{
"name": "CVE-2025-0067",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0067"
},
{
"name": "CVE-2025-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0063"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0027",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-01-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-01-14",
"title": "Bulletin de s\u00e9curit\u00e9 SAP january-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2025.html"
}
]
}
CERTFR-2024-AVI-1054
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | HCM version S4HCMGXX 101 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HCM version S4HCMGXX 101 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-54197",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54197"
},
{
"name": "CVE-2024-47586",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47586"
},
{
"name": "CVE-2024-47577",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47577"
},
{
"name": "CVE-2024-47578",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47578"
},
{
"name": "CVE-2024-47585",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47585"
},
{
"name": "CVE-2024-54198",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54198"
},
{
"name": "CVE-2024-28166",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28166"
},
{
"name": "CVE-2024-41731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41731"
},
{
"name": "CVE-2024-47581",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47581"
},
{
"name": "CVE-2024-47590",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47590"
},
{
"name": "CVE-2024-32732",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32732"
},
{
"name": "CVE-2024-47576",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47576"
},
{
"name": "CVE-2024-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42375"
},
{
"name": "CVE-2024-47579",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47579"
},
{
"name": "CVE-2024-47580",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47580"
},
{
"name": "CVE-2024-47582",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47582"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-1054",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-12-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 SAP december-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2024.html"
}
]
}
CERTFR-2024-AVI-0962
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server Java (Logon Application) version SERVERCORE 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Host Agent version SAPHOSTAGENT 7.22 sans le dernier correctif de sécurité | ||
| SAP | N/A | Cash Management (Cash Operations) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.12 sans le dernier correctif de sécurité | ||
| SAP | N/A | Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java (System Landscape Directory) version LM-SLD 7.5 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java (Logon Application) version SERVERCORE 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Host Agent version SAPHOSTAGENT 7.22 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Cash Management (Cash Operations) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.12 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (System Landscape Directory) version LM-SLD 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-47593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47593"
},
{
"name": "CVE-2024-47586",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47586"
},
{
"name": "CVE-2024-47587",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47587"
},
{
"name": "CVE-2024-47588",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47588"
},
{
"name": "CVE-2024-42372",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42372"
},
{
"name": "CVE-2024-47592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47592"
},
{
"name": "CVE-2024-47590",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47590"
},
{
"name": "CVE-2024-47595",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47595"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0962",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-11-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 SAP november-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html"
}
]
}
CERTFR-2024-AVI-0844
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver BW | NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Backoffice versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4 HANA (Manage Bank Statements) versions S4CORE, 102, 103, 104, 105, 106 et 107 sans le dernier correctif de sécurité | ||
| SAP | N/A | Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal (KMC) version KMC-BC 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 420, 430, 2025, ENTERPRISECLIENTTOOLS 420, 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | HANA Client version HDB_CLIENT 2.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS for Java version 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | SAP NetWeaver Application Server pour plateformes ABAP et ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enterprise Project Connection version 3.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver BW",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Backoffice versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA (Manage Bank Statements) versions S4CORE, 102, 103, 104, 105, 106 et 107 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal (KMC) version KMC-BC 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 420, 430, 2025, ENTERPRISECLIENTTOOLS 420, 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA Client version HDB_CLIENT 2.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for Java version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server pour plateformes ABAP et ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enterprise Project Connection version 3.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-45282",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45282"
},
{
"name": "CVE-2024-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42373"
},
{
"name": "CVE-2024-38809",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38809"
},
{
"name": "CVE-2024-41729",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41729"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-45278",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45278"
},
{
"name": "CVE-2024-45283",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45283"
},
{
"name": "CVE-2024-45277",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45277"
},
{
"name": "CVE-2024-38808",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38808"
},
{
"name": "CVE-2024-47594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47594"
},
{
"name": "CVE-2022-23302",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23302"
},
{
"name": "CVE-2024-22259",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22259"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2024-41730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
},
{
"name": "CVE-2024-37179",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37179"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0844",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP october-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2024.html"
}
]
}
CERTFR-2024-AVI-0671
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver Application Server (ABAP and Java), Web Dispatcher and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.53, 7.77, 7.85, 7.22_EXT, 7.89, 7.54, 7.93, KERNEL 7.22, 7.53, 7.77, 7.85, 7.89, 7.54 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | N/A | Build Apps version 4.11.130 sans le dernier correctif de sécurité | ||
| SAP | N/A | Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM ABAP (Insights Management) versions BBPCRM 700, 701, 702, 712, 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions SAP_UI 754, 755, 756, 757, 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731 et SAP_BASIS 912 sans le dernier correctif de sécurité | ||
| SAP | N/A | Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 912 sans le dernier correctif de sécurité | ||
| SAP | N/A | BEx Web Java Runtime Export Web Service versions BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5 et BIWEBAPP 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité | ||
| SAP | N/A | Landscape Management version VCM 3.00 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Workflow (WebFlow Services) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Shared Service Framework versions SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse - Business Planning and Simulation versions SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Bank Account Management (Manage Banks) versions 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Backoffice version HY_COM 2205 sans le dernier correctif de sécurité | ||
| SAP | N/A | BW/4HANA Transformation and Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | Document Builder versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, SAP_BS_FND 702, SAP_BS_FND 731, SAP_BS_FND 746, SAP_BS_FND 747 et SAP_BS_FND 748 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver Application Server (ABAP and Java), Web Dispatcher and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.53, 7.77, 7.85, 7.22_EXT, 7.89, 7.54, 7.93, KERNEL 7.22, 7.53, 7.77, 7.85, 7.89, 7.54 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Build Apps version 4.11.130 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM ABAP (Insights Management) versions BBPCRM 700, 701, 702, 712, 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_UI 754, 755, 756, 757, 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731 et SAP_BASIS 912 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 912 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BEx Web Java Runtime Export Web Service versions BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5 et BIWEBAPP 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Replication Server versions 16.0.3 et 16.0.4\u00a0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Management version VCM 3.00 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Workflow (WebFlow Services) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Shared Service Framework versions SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse - Business Planning and Simulation versions SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Bank Account Management (Manage Banks) versions 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Backoffice version HY_COM 2205 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BW/4HANA Transformation and Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Builder versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, SAP_BS_FND 702, SAP_BS_FND 731, SAP_BS_FND 746, SAP_BS_FND 747 et SAP_BS_FND 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-37176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37176"
},
{
"name": "CVE-2024-41732",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41732"
},
{
"name": "CVE-2024-34689",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34689"
},
{
"name": "CVE-2024-33003",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33003"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2024-41733",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41733"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2024-29415",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29415"
},
{
"name": "CVE-2024-41734",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41734"
},
{
"name": "CVE-2024-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42373"
},
{
"name": "CVE-2024-41737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41737"
},
{
"name": "CVE-2024-34683",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-34688",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34688"
},
{
"name": "CVE-2024-33005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33005"
},
{
"name": "CVE-2024-28166",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28166"
},
{
"name": "CVE-2024-41731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41731"
},
{
"name": "CVE-2024-39594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39594"
},
{
"name": "CVE-2023-30533",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30533"
},
{
"name": "CVE-2024-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42376"
},
{
"name": "CVE-2024-39591",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39591"
},
{
"name": "CVE-2024-41736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41736"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2023-0023",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0023"
},
{
"name": "CVE-2024-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42375"
},
{
"name": "CVE-2024-39593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39593"
},
{
"name": "CVE-2024-41730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
},
{
"name": "CVE-2024-41735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41735"
},
{
"name": "CVE-2024-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42374"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0671",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-08-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP august-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2024.html"
}
]
}
CERTFR-2024-AVI-0554
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Enable Now versions antérieures à WPB_MANAGER_HANA 10 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Workflow (WebFlow Services) versions antérieures à SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enable Now versions antérieures à WPB_MANAGER_CE 10 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse - Business Planning and Simulation versions antérieures à SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce versions antérieures à HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enable Now versions antérieures à ENABLE_NOW_CONSUMP_DEL 1704 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM WebClient UI versions antérieures à S4FND 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité WEBCUIF 701, 731, 746, 747, 748, 800, 801 | ||
| SAP | N/A | CRM WebClient UI versions antérieures à S4FND 104 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions antérieures à S4CORE 102 et 103 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse - Business Planning and Simulation versions antérieures à SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA Finance (Advanced Payment Management) versions antérieures à S4CORE 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions antérieures à SAP_BASIS 700,701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795 et 796 sans le dernier correctif de sécurité | ||
| SAP | N/A | GUI pour Windows versions antérieures à BC-FES-GUI 8 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Knowledge Management XMLEditor versions antérieures à KMC-WPC 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM WebClient UI versions antérieures à WEBCUIF 701, 731, 746, 747, 748, 800, 801 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions antérieures à S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_HANA 10 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Workflow (WebFlow Services) versions ant\u00e9rieures \u00e0 SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_CE 10 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions ant\u00e9rieures \u00e0 HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enable Now versions ant\u00e9rieures \u00e0 ENABLE_NOW_CONSUMP_DEL 1704 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9 WEBCUIF 701, 731, 746, 747, 748, 800, 801",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 104 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions ant\u00e9rieures \u00e0 S4CORE 102 et 103 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Finance (Advanced Payment Management) versions ant\u00e9rieures \u00e0 S4CORE 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions ant\u00e9rieures \u00e0 SAP_BASIS 700,701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795 et 796 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI pour Windows versions ant\u00e9rieures \u00e0 BC-FES-GUI 8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Knowledge Management XMLEditor versions ant\u00e9rieures \u00e0 KMC-WPC 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 WEBCUIF 701, 731, 746, 747, 748, 800, 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions ant\u00e9rieures \u00e0 S4COREOP 104, 105,\n106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-34689",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34689"
},
{
"name": "CVE-2024-37174",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37174"
},
{
"name": "CVE-2024-39597",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39597"
},
{
"name": "CVE-2024-37171",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37171"
},
{
"name": "CVE-2024-37172",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37172"
},
{
"name": "CVE-2024-34685",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34685"
},
{
"name": "CVE-2024-39596",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39596"
},
{
"name": "CVE-2024-34683",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-39600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39600"
},
{
"name": "CVE-2024-37175",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37175"
},
{
"name": "CVE-2024-39594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39594"
},
{
"name": "CVE-2024-37173",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37173"
},
{
"name": "CVE-2024-39599",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39599"
},
{
"name": "CVE-2024-39598",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39598"
},
{
"name": "CVE-2024-39593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39593"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2024-34692",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34692"
},
{
"name": "CVE-2024-39595",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39595"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0554",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP",
"url": "https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/knowledge-base/security-notes-news/2024%2007%20Patch%20Day%20Blog%20V1.pdf"
}
]
}
CERTFR-2024-AVI-0395
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Enable Now version 1704 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Client versions 6.5, 7.0 et 7.70 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de sécurité | ||
| SAP | N/A | SAPUI5 versions 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce version HY_COM 2205 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP S/4 HANA (Manage Bank Statement Reprocessing Rules) versions SAPSCORE 131, S4CORE 105, S4CORE 106, S4CORE107 et S4CORE 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP BusinessObjects Business Intelligence Platform (Webservices) versions 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | Replication Server | AP Replication Server versions 16.0, 16.0.3 et 16.0.4 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA (Document Service Handler for DPS) versions SAP_BASIS 740 et SAP_BASIS 750 sans le dernier correctif de sécurité | ||
| SAP | N/A | My Travel Requests version 600 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects (Business Intelligence Platform) versions 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP Bank Account Management versions 100, 101, 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | AP Global Label Management (GLM) versions 605, 606, 616 et 617 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Enable Now version 1704 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Client versions 6.5, 7.0 et 7.70 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce version HY_COM 2205 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP S/4 HANA (Manage Bank Statement Reprocessing Rules) versions SAPSCORE 131, S4CORE 105, S4CORE 106, S4CORE107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP BusinessObjects Business Intelligence Platform (Webservices) versions 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP Replication Server versions 16.0, 16.0.3 et 16.0.4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Replication Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Document Service Handler for DPS) versions SAP_BASIS 740 et SAP_BASIS 750 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "My Travel Requests version 600 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects (Business Intelligence Platform) versions 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP Bank Account Management versions 100, 101, 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "AP Global Label Management (GLM) versions 605, 606, 616 et 617 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-34687",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34687"
},
{
"name": "CVE-2024-33008",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33008"
},
{
"name": "CVE-2024-4138",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4138"
},
{
"name": "CVE-2022-36364",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36364"
},
{
"name": "CVE-2024-4139",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4139"
},
{
"name": "CVE-2019-17495",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17495"
},
{
"name": "CVE-2024-32733",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32733"
},
{
"name": "CVE-2024-33009",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33009"
},
{
"name": "CVE-2024-33002",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33002"
},
{
"name": "CVE-2024-28165",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28165"
},
{
"name": "CVE-2024-32731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32731"
},
{
"name": "CVE-2024-32730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32730"
},
{
"name": "CVE-2024-33000",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33000"
},
{
"name": "CVE-2024-33007",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33007"
},
{
"name": "CVE-2024-33004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33004"
},
{
"name": "CVE-2024-33006",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33006"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0395",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-05-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 14 mai 2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html"
}
]
}
CERTFR-2024-AVI-0283
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Business Connector version 4.8 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4 HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver version 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54 et KERNEL 7.93 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4 HANA (Cash Management) versions S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | Employee Self Service (Fiori My Leave Request) version 605 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java User Management Engine versions SERVERCORE 7.50, J2EE-APPS 7.50 et UMEADMIN 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Group Reporting Data Collection (Enter Package Data) versions S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108 et SAP_GRDC_CLOUD 1.0.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Web Intelligence versions 4.2 et 4.3 sans le dernier correctif de sécurité | ||
| SAP | N/A | Edge Integration Cell versions antérieures à 8.13.5 | ||
| SAP | N/A | Asset Accounting versions SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_FIN617, SAP_FIN 618 et SAP_FIN700 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Business Connector version 4.8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54 et KERNEL 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA (Cash Management) versions S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Employee Self Service (Fiori My Leave Request) version 605 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java User Management Engine versions SERVERCORE 7.50, J2EE-APPS 7.50 et UMEADMIN 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Group Reporting Data Collection (Enter Package Data) versions S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108 et SAP_GRDC_CLOUD 1.0.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Web Intelligence versions 4.2 et 4.3 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Edge Integration Cell versions ant\u00e9rieures \u00e0 8.13.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Asset Accounting versions SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_FIN617, SAP_FIN 618 et SAP_FIN700 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-30216",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30216"
},
{
"name": "CVE-2024-30214",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30214"
},
{
"name": "CVE-2024-28167",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28167"
},
{
"name": "CVE-2024-30218",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30218"
},
{
"name": "CVE-2024-30217",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30217"
},
{
"name": "CVE-2024-27898",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27898"
},
{
"name": "CVE-2024-27899",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27899"
},
{
"name": "CVE-2024-30215",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30215"
},
{
"name": "CVE-2022-29613",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29613"
},
{
"name": "CVE-2024-25646",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25646"
},
{
"name": "CVE-2024-27901",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27901"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0283",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-04-09T00:00:00.000000"
},
{
"description": "Ajout de la vuln\u00e9rabilit\u00e9 CVE-2022-29613",
"revision_date": "2024-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits SAP\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance,\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code\nindirecte \u00e0 distance (XSS).\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 09 avril 2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html"
}
]
}
CERTFR-2024-AVI-0209
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver AS Java version 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Client versions 6.5, 7.0 et 7.70 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver (Enterprise Portal) version 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Build Apps versions antérieures à 4.9.145 | ||
| SAP | N/A | HANA Database version 2.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce versions HY_COM 2105, HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | HANA XS Advanced version 1.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform version 4.3 sans le dernier correctif de sécurité | ||
| SAP | N/A | ABAP Platform versions 758 et 795 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver (WSRM) version 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Process Integration (Support Web Pages) version 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori Front End Server version 605 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS ABAP pour les applications basées sur SAPGUI versions 7.89 et 7.93 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver AS Java version 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Client versions 6.5, 7.0 et 7.70 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Enterprise Portal) version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Build Apps versions ant\u00e9rieures \u00e0 4.9.145",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA Database version 2.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions HY_COM 2105, HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA XS Advanced version 1.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform version 4.3 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP Platform versions 758 et 795 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (WSRM) version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Process Integration (Support Web Pages) version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori Front End Server version 605 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP pour les applications bas\u00e9es sur SAPGUI versions 7.89 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-39439",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39439"
},
{
"name": "CVE-2022-3075",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3075"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2024-22133",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22133"
},
{
"name": "CVE-2024-25644",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25644"
},
{
"name": "CVE-2023-50164",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50164"
},
{
"name": "CVE-2023-7024",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-7024"
},
{
"name": "CVE-2019-10744",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10744"
},
{
"name": "CVE-2024-27900",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27900"
},
{
"name": "CVE-2024-22127",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22127"
},
{
"name": "CVE-2024-27902",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27902"
},
{
"name": "CVE-2024-28163",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28163"
},
{
"name": "CVE-2023-5217",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5217"
},
{
"name": "CVE-2024-25645",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25645"
},
{
"name": "CVE-2023-4863",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4863"
},
{
"name": "CVE-2023-6345",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6345"
},
{
"name": "CVE-2022-2856",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2856"
},
{
"name": "CVE-2023-3079",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3079"
},
{
"name": "CVE-2023-2136",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2136"
},
{
"name": "CVE-2024-0519",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0519"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0209",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-03-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits SAP\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es et une ex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de\nservice \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 12 mars 2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2024.html"
}
]
}
CERTFR-2024-AVI-0125
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702 | ||
| SAP | N/A | SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731 | ||
| SAP | N/A | SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java (Guided Procedures) version 7.50 | ||
| SAP | N/A | SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804 | ||
| SAP | N/A | SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java (User Admin Application) version 7.50 | ||
| SAP | N/A | SAP Cloud Connector version 2.0 | ||
| SAP | N/A | SAP Fiori app ("My Overtime Requests") versions 605 | ||
| SAP | N/A | IDES Systems toutes versions | ||
| SAP | N/A | SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I | ||
| SAP | N/A | SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | N/A | BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101 | ||
| SAP | N/A | SAP Companion versions antérieures à 3.1.38 | ||
| SAP | SAP CRM WebClient UI | SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Master Data Governance versions MDG_FND 731, MDG_FND 732, MDG_FND 746, MDG_FND 747, MDG_FND 748, MDG_FND 749, MDG_FND 752, MDG_FND 800, MDG_FND 802, MDG_FND 803, MDG_FND 804, MDG_FND 805, MDG_FND 806, MDG_FND 807, MDG_FND 808 et SAP_BS_FND 702",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NWBC for HTML versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 et SAP_BASIS 731",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java (Guided Procedures) version 7.50",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Master Data Governance Material versions 618, 619, 620, 621, 622, 800, 801, 802, 803 et 804",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP (SAP Kernel) versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 et KRNL64UC 7.53",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java (User Admin Application) version 7.50",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Cloud Connector version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori app (\"My Overtime Requests\") versions 605",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "IDES Systems toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C et 75I",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BAM (Bank Account Management) versions SAP_FIN 618, SAP_FIN 730, S4CORE 100 et 101",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Companion versions ant\u00e9rieures \u00e0 3.1.38",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 801",
"product": {
"name": "SAP CRM WebClient UI",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-24741",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24741"
},
{
"name": "CVE-2024-22132",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22132"
},
{
"name": "CVE-2024-24739",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24739"
},
{
"name": "CVE-2023-49580",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49580"
},
{
"name": "CVE-2024-25643",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25643"
},
{
"name": "CVE-2024-24742",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24742"
},
{
"name": "CVE-2024-25642",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25642"
},
{
"name": "CVE-2024-24740",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24740"
},
{
"name": "CVE-2024-22129",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22129"
},
{
"name": "CVE-2024-22126",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22126"
},
{
"name": "CVE-2024-22128",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22128"
},
{
"name": "CVE-2024-22131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22131"
},
{
"name": "CVE-2024-22130",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22130"
},
{
"name": "CVE-2023-49058",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49058"
},
{
"name": "CVE-2024-24743",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24743"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0125",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-02-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SAP. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP february-2024 du 13 f\u00e9vrier 2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2024.html"
}
]
}
CERTFR-2024-AVI-0018
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Business Application Studio, Web IDE Full-Stack et Web IDE pour SAP HANA | ||
| SAP | N/A | NetWeaver (Internet Communication Manager) versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53 et WEBDISP 7.54 | ||
| SAP | Replication Server | LT Replication Server versions S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 | ||
| SAP | N/A | Business Technology Platform (BTP) Security Services Integration Libraries | ||
| SAP | N/A | NetWeaver AS ABAP et ABAP Platform versions KRNL64UC 7.53, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.94, KERNEL 7.93 et KERNEL 7.95 | ||
| SAP | N/A | S/4HANA Finance (Advanced Payment Management) versions SAPSCORE 128 et S4CORE 10 | ||
| SAP | N/A | NetWeaver ABAP Application Server et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793 et SAP_BASIS 79 | ||
| SAP | N/A | NetWeaver AS for Java (Log Viewer) version ENGINEAPI 7.50, SERVERCORE 7.50 et J2EE-APPS 7.50 | ||
| SAP | N/A | Marketing (Contacts App) version 160 | ||
| SAP | N/A | Web Dispatcher versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.90, WEBDISP 7.94 et WEBDISP 7.95 | ||
| SAP | N/A | Edge Integration Cell versions supérieures ou égales à 8.9.13 | ||
| SAP | N/A | Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) version 1.0 | ||
| SAP | N/A | Application Interface Framework (File Adapter) version 702 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Business Application Studio, Web IDE Full-Stack et Web IDE pour SAP HANA",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Internet Communication Manager) versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53 et WEBDISP 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "LT Replication Server versions S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108",
"product": {
"name": "Replication Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Technology Platform (BTP) Security Services Integration Libraries",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP et ABAP Platform versions KRNL64UC 7.53, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.94, KERNEL 7.93 et KERNEL 7.95",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Finance (Advanced Payment Management) versions SAPSCORE 128 et S4CORE 10",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Application Server et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793 et SAP_BASIS 79",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for Java (Log Viewer) version ENGINEAPI 7.50, SERVERCORE 7.50 et J2EE-APPS 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Marketing (Contacts App) version 160",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.90, WEBDISP 7.94 et WEBDISP 7.95",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Edge Integration Cell versions sup\u00e9rieures ou \u00e9gales \u00e0 8.9.13",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) version 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Application Interface Framework (File Adapter) version 702",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-21736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21736"
},
{
"name": "CVE-2024-21734",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21734"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-31405",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31405"
},
{
"name": "CVE-2024-21738",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21738"
},
{
"name": "CVE-2024-22124",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22124"
},
{
"name": "CVE-2024-21735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21735"
},
{
"name": "CVE-2024-21737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21737"
},
{
"name": "CVE-2023-50423",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50423"
},
{
"name": "CVE-2023-49583",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49583"
},
{
"name": "CVE-2024-22125",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22125"
},
{
"name": "CVE-2023-50422",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50422"
},
{
"name": "CVE-2023-50424",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50424"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0018",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-01-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 09 janvier 2024",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-1020
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP EMARSYS SDK ANDROID version 3.6.2 | ||
| SAP | N/A | Librairie cloud-security-services-integration-library versions antérieures à 2.17.0 | ||
| SAP | N/A | SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604 et SAP_HRCIE 608 | ||
| SAP | N/A | SAP Master Data Governance versions 731, 732, 746, 747, 748, 749, 800, 751,752,801,802, 803, 804, 805, 806, 807 et 808 | ||
| SAP | N/A | Business Objects BI Platform versions 420 et 430 | ||
| SAP | N/A | SAP BusinessObjects Web Intelligence version 420 | ||
| SAP | N/A | SAP Biller Direct versions 635 et 750 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200 | ||
| SAP | N/A | SAP Cloud Connector version 2.0 | ||
| SAP | N/A | Librairie sap-xssec versions antérieures à 4.1.0 | ||
| SAP | N/A | Librairie github.com/sap/cloud-security-client-go versions antérieures à 0.17.0 | ||
| SAP | Commerce Cloud | SAP Commerce Cloud version 8.1 | ||
| SAP | N/A | SAP Solution Manager version 720 | ||
| SAP | N/A | Librairie @sap/xssec versions antérieures à 3.6.0 | ||
| SAP | N/A | SAP ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807 | ||
| SAP | N/A | SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS731, SAP_BASIS740 et SAP_BASIS750 | ||
| SAP | N/A | SAP_BS_FND version 702 | ||
| SAP | N/A | Librairie cloud-security-services-integration-library versions 3.3.x antérieures à 3.3.0 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.7 | ||
| SAP | N/A | SAP Fiori Launchpad versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200 et SAP_BASIS 793 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP EMARSYS SDK ANDROID version 3.6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie cloud-security-services-integration-library versions ant\u00e9rieures \u00e0 2.17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604 et SAP_HRCIE 608",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Master Data Governance versions 731, 732, 746, 747, 748, 749, 800, 751,752,801,802, 803, 804, 805, 806, 807 et 808",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects BI Platform versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Web Intelligence version 420",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Biller Direct versions 635 et 750",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Cloud Connector version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie sap-xssec versions ant\u00e9rieures \u00e0 4.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie github.com/sap/cloud-security-client-go versions ant\u00e9rieures \u00e0 0.17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce Cloud version 8.1",
"product": {
"name": "Commerce Cloud",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Solution Manager version 720",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie @sap/xssec versions ant\u00e9rieures \u00e0 3.6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS731, SAP_BASIS740 et SAP_BASIS750",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP_BS_FND version 702",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Librairie cloud-security-services-integration-library versions 3.3.x ant\u00e9rieures \u00e0 3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori Launchpad versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200 et SAP_BASIS 793",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-49587",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49587"
},
{
"name": "CVE-2023-42481",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42481"
},
{
"name": "CVE-2023-49584",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49584"
},
{
"name": "CVE-2023-49581",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49581"
},
{
"name": "CVE-2023-36922",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36922"
},
{
"name": "CVE-2023-42476",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42476"
},
{
"name": "CVE-2023-49580",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49580"
},
{
"name": "CVE-2023-6542",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6542"
},
{
"name": "CVE-2023-42479",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42479"
},
{
"name": "CVE-2023-42478",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42478"
},
{
"name": "CVE-2021-23413",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23413"
},
{
"name": "CVE-2023-50423",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50423"
},
{
"name": "CVE-2023-49583",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49583"
},
{
"name": "CVE-2023-49577",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49577"
},
{
"name": "CVE-2023-49578",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49578"
},
{
"name": "CVE-2023-50422",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50422"
},
{
"name": "CVE-2023-49058",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49058"
},
{
"name": "CVE-2023-50424",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50424"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-1020",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-12-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP ucQrx6G du 12 d\u00e9cembre 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0942
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java version 7.5 | ||
| SAP | N/A | SAPSSOEXT version 17 | ||
| SAP | N/A | SAPExtended Application Services et Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00 | ||
| SAP | N/A | SAPHost Agent version 722 | ||
| SAP | N/A | Product-SAP IQ version 16.0 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89 | ||
| SAP | N/A | Product-SAP ASE versions 15.7, 16.0 | ||
| SAP | N/A | SAP Business One version 10.0 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | SAP NetWeaver Application Server ABAP et ABAP Platform versions KERNEL 722, KERNEL 7.53, KERNEL 7.77,KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT | ||
| SAP | N/A | Product-SAP SQL Anywhere versions 16.0, 17.0 | ||
| SAP | N/A | SAP CommonCryptoLib version 8 | ||
| SAP | N/A | Product-SAP ASE Cluster Edition version 15.7 | ||
| SAP | N/A | Product-SAP Event Stream Processor version 5.1 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS ABAP, SAP NetWeaver AS Java et ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT | ||
| SAP | N/A | SAPHANA Database version 2.0 | ||
| SAP | N/A | SAPContent Server versions 6.50, 7.53, 7.54 | ||
| SAP | Replication Server | Product-SAP Replication Server version 15.7 | ||
| SAP | N/A | NetWeaver AS Java version 7.50 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP NetWeaver AS Java version 7.5",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPSSOEXT version 17",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPExtended Application Services et Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHost Agent version 722",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP IQ version 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP ASE versions 15.7, 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business One version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions KERNEL 722, KERNEL 7.53, KERNEL 7.77,KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP SQL Anywhere versions 16.0, 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CommonCryptoLib version 8",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP ASE Cluster Edition version 15.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP Event Stream Processor version 5.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java et ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHANA Database version 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPContent Server versions 6.50, 7.53, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP Replication Server version 15.7",
"product": {
"name": "Replication Server",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-40309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40309"
},
{
"name": "CVE-2023-42477",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42477"
},
{
"name": "CVE-2023-31403",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31403"
},
{
"name": "CVE-2023-42480",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42480"
},
{
"name": "CVE-2023-41366",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41366"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0942",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-11-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un contournement de la politique de s\u00e9curit\u00e9 et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP ucQrx6G du 14 novembre 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0822
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP NetWeaverAS Java version 7.50 | ||
| SAP | N/A | SAP NetWeaver AS pour Java (Log Viewer) versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50 | ||
| SAP | N/A | SAP BusinessObjects Web Intelligence version 420 | ||
| SAP | N/A | SAP PowerDesigner Client version 16.7 | ||
| SAP | N/A | SAP NetWeaver AS pour Java (Log Viewer) version ENGINE API 7.50 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0, 7.70 | ||
| SAP | N/A | SAP S/4HANA Core versions S4CORE 102, S4CORE 103, S4CORE 104, S4CORE 105,S4CORE 106, SAPSCORE 128 | ||
| SAP | N/A | S/4HANA (Manage Withholding Tax Items) version 106 | ||
| SAP | N/A | SAP Business One (B1i), version 10 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP NetWeaverAS Java version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS pour Java (Log Viewer) versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Web Intelligence version 420",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP PowerDesigner Client version 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS pour Java (Log Viewer) version ENGINE API 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0, 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA Core versions S4CORE 102, S4CORE 103, S4CORE 104, S4CORE 105,S4CORE 106, SAPSCORE 128",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Manage Withholding Tax Items) version 106",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business One (B1i), version 10",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-41365",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41365"
},
{
"name": "CVE-2023-42477",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42477"
},
{
"name": "CVE-2023-31405",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31405"
},
{
"name": "CVE-2023-42474",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42474"
},
{
"name": "CVE-2023-42475",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42475"
},
{
"name": "CVE-2023-42473",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42473"
},
{
"name": "CVE-2023-40310",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40310"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0822",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-10-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP 2023-10-11 du 10 octobre 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026d=2023-10-11"
}
]
}
CERTFR-2023-AVI-0737
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Business Objects Business Intelligence Platform (CMC) versions 420 et 430 | ||
| SAP | N/A | SAP S/4HANA (Create Single Payment application) versions 100, 101, 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (versions Management System) versions 430 | ||
| SAP | N/A | SAPExtended Application Services and Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00 | ||
| SAP | N/A | SAP NetWeaver Process Integration versions 7.50 | ||
| SAP | N/A | SAPHANA Database versions 2.0 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430 | ||
| SAP | N/A | SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89 | ||
| SAP | N/A | S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106 et 107 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | N/A | SAP NetWeaver AS ABAP (applications based on Unified Rendering) versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702 et SAP_BASIS 731 | ||
| SAP | N/A | SAP NetWeaver (Guided Procedures) versions 7.50 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200 | ||
| SAP | N/A | SAPSSOEXT versions 17 | ||
| SAP | N/A | Product-SAP BusinessObjects Suite (Installer) versions 420 et 430 | ||
| SAP | N/A | SAP Quotation Management Insurance (FS-QUO) versions 400, 510, 700 et 800 | ||
| SAP | N/A | SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106 | ||
| SAP | N/A | SAPHost Agent versions 722 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) versions 420 | ||
| SAP | N/A | SAPContent Server versions 6.50, 7.53, 7.54 | ||
| SAP | N/A | SAP PowerDesignerClient versions 16.7 | ||
| SAP | N/A | S4 HANA ABAP (Manage checkbook apps) versions 102, 103, 104, 105, 106 et 107 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22 et KERNEL64NUC 7.22EXT |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Business Objects Business Intelligence Platform (CMC) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA (Create Single Payment application) versions 100, 101, 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (versions Management System) versions 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPExtended Application Services and Runtime (XSA) versions SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration versions 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHANA Database versions 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106 et 107",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP (applications based on Unified Rendering) versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702 et SAP_BASIS 731",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Guided Procedures) versions 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPSSOEXT versions 17",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product-SAP BusinessObjects Suite (Installer) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Quotation Management Insurance (FS-QUO) versions 400, 510, 700 et 800",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPHost Agent versions 722",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) versions 420",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPContent Server versions 6.50, 7.53, 7.54",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP PowerDesignerClient versions 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4 HANA ABAP (Manage checkbook apps) versions 102, 103, 104, 105, 106 et 107",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22 et KERNEL64NUC 7.22EXT",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-40309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40309"
},
{
"name": "CVE-2023-25616",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25616"
},
{
"name": "CVE-2023-40306",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40306"
},
{
"name": "CVE-2021-41182",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41182"
},
{
"name": "CVE-2023-41367",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41367"
},
{
"name": "CVE-2023-40624",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40624"
},
{
"name": "CVE-2023-41369",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41369"
},
{
"name": "CVE-2023-40621",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40621"
},
{
"name": "CVE-2023-41368",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41368"
},
{
"name": "CVE-2022-41272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
},
{
"name": "CVE-2023-37489",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37489"
},
{
"name": "CVE-2023-42472",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42472"
},
{
"name": "CVE-2021-41184",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41184"
},
{
"name": "CVE-2021-41183",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41183"
},
{
"name": "CVE-2023-40308",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40308"
},
{
"name": "CVE-2023-40622",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40622"
},
{
"name": "CVE-2023-40625",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40625"
},
{
"name": "CVE-2023-40623",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40623"
},
{
"name": "CVE-2023-24998",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0737",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-09-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2023-09-12",
"title": "Bulletin de s\u00e9curit\u00e9 SAP",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1\u0026d=2023-09-13"
}
]
}
CERTFR-2023-AVI-0635
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Business One version 10.0 | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform version 420 | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions 430 | ||
| SAP | N/A | BusinessObjects Business Intelligence (installer) versions 420 et 430 | ||
| SAP | N/A | Commerce (OCC API) versions HY_COM 2105, HY_COM 2205 et COM_CLOUD 2211 | ||
| SAP | N/A | PowerDesigner version 16.7 | ||
| SAP | N/A | NetWeaver Process Integration versions SAP_XIESR 7.50, SAP_XITOOL 7.50 et SAP_XIAF 7.50 | ||
| SAP | N/A | Commerce versions HY_COM 2105, HY_COM 2205 et COM_CLOUD 2211 | ||
| SAP | N/A | ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807 | ||
| SAP | N/A | NetWeaver AS ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793 et SAP_BASIS 804 | ||
| SAP | N/A | NetWeaver (BI CONT ADD ON) versions 707, 737, 747 et 757 | ||
| SAP | N/A | Business One (B1i Layer) version 10.0 | ||
| SAP | N/A | Supplier Relationship Management versions 600, 602, 603, 604, 605, 606, 616 et 617 | ||
| SAP | N/A | Business One (Service Layer) version 10.0 | ||
| SAP | N/A | Message Server versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22 et KRNL64NUC 7.22EX |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Business One version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform version 420",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence (installer) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce (OCC API) versions HY_COM 2105, HY_COM 2205 et COM_CLOUD 2211",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PowerDesigner version 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Process Integration versions SAP_XIESR 7.50, SAP_XITOOL 7.50 et SAP_XIAF 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions HY_COM 2105, HY_COM 2205 et COM_CLOUD 2211",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793 et SAP_BASIS 804",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (BI CONT ADD ON) versions 707, 737, 747 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One (B1i Layer) version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management versions 600, 602, 603, 604, 605, 606, 616 et 617",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One (Service Layer) version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Message Server versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22 et KRNL64NUC 7.22EX",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-39439",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39439"
},
{
"name": "CVE-2023-33993",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33993"
},
{
"name": "CVE-2023-39437",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39437"
},
{
"name": "CVE-2023-36926",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36926"
},
{
"name": "CVE-2023-36922",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36922"
},
{
"name": "CVE-2023-36923",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36923"
},
{
"name": "CVE-2023-33989",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33989"
},
{
"name": "CVE-2023-37492",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37492"
},
{
"name": "CVE-2023-37483",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37483"
},
{
"name": "CVE-2023-39440",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39440"
},
{
"name": "CVE-2023-39436",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39436"
},
{
"name": "CVE-2023-37491",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37491"
},
{
"name": "CVE-2023-37484",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37484"
},
{
"name": "CVE-2023-37490",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37490"
},
{
"name": "CVE-2023-37487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37487"
},
{
"name": "CVE-2023-37486",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37486"
},
{
"name": "CVE-2023-37488",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37488"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0635",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-08-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 08 ao\u00fbt 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0531
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Web Dispatcher versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54,KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00 et SAP_EXTENDED_APP_SERVICES 1 | ||
| SAP | N/A | SAP Solution Manager (Diagnostic Agent) version 7.20 | ||
| SAP | N/A | SAP NetWeaver AS for Java (Log Viewer) versions ENGINEAPI 7.50, SERVERCORE 7.50 et J2EE-APPS 7.50 | ||
| SAP | N/A | SAP NetWeaver (BI CONT ADD ON) versions 707, 737, 747 et 757 | ||
| SAP | N/A | SAP Business Warehouseand SAP BW/4HANA versions SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200 et DW4CORE 300 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | N/A | SAP ECC et SAP S/4HANA (IS-OIL), versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807 | ||
| SAP | N/A | SAP SQL Anywhere version 17.0 | ||
| SAP | N/A | SAP NetWeaver Process Integration (Message Display Tool) version SAP_XIAF 7.50 | ||
| SAP | N/A | SAP NetWeaver AS ABAP et ABAP Platform versions KRNL64NUC7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92 et KERNEL 7.93 | ||
| SAP | N/A | SAP UI5 Variant Management versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200 | ||
| SAP | N/A | SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10 et ENABLE_NOW_CONSUMP_DEL 1704 | ||
| SAP | N/A | SAP ERP Defense Forces et Public Security versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806 et 807 | ||
| SAP | N/A | SAP S/4HANA (Manage Journal Entry Template) versions S4CORE 104, 105, 106 et 107 | ||
| SAP | N/A | SAP BusinessObjects BI Platform (Enterprise) versions 420 et 430 | ||
| SAP | N/A | SAP NetWeaver Process Integration (Runtime Workbench) version SAP_XITOOL 7.50 | ||
| SAP | N/A | SAP Web Dispatcher versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00 et SAP_EXTENDED_APP_SERVICES 1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Web Dispatcher versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54,KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00 et SAP_EXTENDED_APP_SERVICES 1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Solution Manager (Diagnostic Agent) version 7.20",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS for Java (Log Viewer) versions ENGINEAPI 7.50, SERVERCORE 7.50 et J2EE-APPS 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (BI CONT ADD ON) versions 707, 737, 747 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Warehouseand SAP BW/4HANA versions SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200 et DW4CORE 300",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP ECC et SAP S/4HANA (IS-OIL), versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP SQL Anywhere version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration (Message Display Tool) version SAP_XIAF 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS ABAP et ABAP Platform versions KRNL64NUC7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92 et KERNEL 7.93",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP UI5 Variant Management versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10 et ENABLE_NOW_CONSUMP_DEL 1704",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP ERP Defense Forces et Public Security versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806 et 807",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA (Manage Journal Entry Template) versions S4CORE 104, 105, 106 et 107",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects BI Platform (Enterprise) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration (Runtime Workbench) version SAP_XITOOL 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Web Dispatcher versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00 et SAP_EXTENDED_APP_SERVICES 1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-36921",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36921"
},
{
"name": "CVE-2023-35874",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35874"
},
{
"name": "CVE-2023-36922",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36922"
},
{
"name": "CVE-2023-31405",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31405"
},
{
"name": "CVE-2023-33991",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33991"
},
{
"name": "CVE-2023-35873",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35873"
},
{
"name": "CVE-2023-35870",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35870"
},
{
"name": "CVE-2023-33992",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33992"
},
{
"name": "CVE-2023-33987",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33987"
},
{
"name": "CVE-2023-33989",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33989"
},
{
"name": "CVE-2023-33988",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33988"
},
{
"name": "CVE-2023-33990",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33990"
},
{
"name": "CVE-2023-36924",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36924"
},
{
"name": "CVE-2023-36920",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36920"
},
{
"name": "CVE-2023-35871",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35871"
},
{
"name": "CVE-2023-36918",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36918"
},
{
"name": "CVE-2023-36925",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36925"
},
{
"name": "CVE-2023-35872",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35872"
},
{
"name": "CVE-2023-36919",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36919"
},
{
"name": "CVE-2023-36917",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36917"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0531",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-07-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 11 juillet 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0454
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Knowledge Warehouse versions 7.30, 7.31, 7.40 et 7.50 | ||
| SAP | N/A | Master Data Synchronization (MDS COMPARE TOOL) versions SAP_APPL 600, 602, 603, 604, 605, 606 et 616 | ||
| SAP | N/A | SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80 | ||
| SAP | N/A | SAP CRM ABAP (Grantor Management) version 430 | ||
| SAP | N/A | SAP NetWeaver (Change and Transport System) versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | N/A | SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) versions 104, 105 et 106 | ||
| SAP | N/A | SAP NetWeaver (Design Time Repository) version 7.50 | ||
| SAP | N/A | SAP UI5 Variant Management versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP Plant Connectivity version 15.5 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal version 7.50 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Knowledge Warehouse versions 7.30, 7.31, 7.40 et 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Master Data Synchronization (MDS COMPARE TOOL) versions SAP_APPL 600, 602, 603, 604, 605, 606 et 616",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM (WebClient UI) versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM ABAP (Grantor Management) version 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Change and Transport System) versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) versions 104, 105 et 106",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (Design Time Repository) version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP UI5 Variant Management versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Plant Connectivity version 15.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal version 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 200",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-42063",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42063"
},
{
"name": "CVE-2023-32115",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32115"
},
{
"name": "CVE-2023-33991",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33991"
},
{
"name": "CVE-2023-33986",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33986"
},
{
"name": "CVE-2023-2827",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2827"
},
{
"name": "CVE-2023-30743",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30743"
},
{
"name": "CVE-2023-33984",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33984"
},
{
"name": "CVE-2023-30742",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30742"
},
{
"name": "CVE-2023-32114",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32114"
},
{
"name": "CVE-2023-31406",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31406"
},
{
"name": "CVE-2022-22542",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22542"
},
{
"name": "CVE-2023-33985",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33985"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0454",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 13 juin 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0369
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP 3D Visual Enterprise License Manager version 15 | ||
| SAP | N/A | SAP Commerce versions 2211, 2105 et 2205 | ||
| SAP | N/A | SAP Application Interface Framework (ODATA service) versions 755 et 756 | ||
| SAP | N/A | SAP Commerce (Backoffice) versions 2105 et 2205 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform versions 420 et 430 | ||
| SAP | SAP CRM WebClient UI | SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80 | ||
| SAP | N/A | SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 20 | ||
| SAP | N/A | SAP GUI pour Windows versions 7.70 et 8.0 | ||
| SAP | N/A | SAP IBP EXCEL ADD-IN versions 2211, 2302 et 2305 | ||
| SAP | N/A | SAP BusinessObjects Intelligence Platform versions 420 et 430 | ||
| SAP | N/A | SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50 et CORE-TOOLS 7.50 | ||
| SAP | N/A | Vendor Master Hierarchy versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618 et S4CORE 100 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Central Management Service) versions 420 et 430 | ||
| SAP | N/A | SAP PowerDesigner (Proxy) version 16.7 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP 3D Visual Enterprise License Manager version 15",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 2211, 2105 et 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (ODATA service) versions 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce (Backoffice) versions 2105 et 2205",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM WebClient UI versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800 et WEBCUIF 80",
"product": {
"name": "SAP CRM WebClient UI",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPUI5 versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757 et UI_700 20",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI pour Windows versions 7.70 et 8.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP IBP EXCEL ADD-IN versions 2211, 2302 et 2305",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Intelligence Platform versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50 et CORE-TOOLS 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Vendor Master Hierarchy versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618 et S4CORE 100",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Central Management Service) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP PowerDesigner (Proxy) version 16.7",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-44155",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44155"
},
{
"name": "CVE-2023-31407",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31407"
},
{
"name": "CVE-2023-30741",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30741"
},
{
"name": "CVE-2021-44152",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44152"
},
{
"name": "CVE-2022-41966",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41966"
},
{
"name": "CVE-2023-29188",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29188"
},
{
"name": "CVE-2023-29080",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29080"
},
{
"name": "CVE-2022-27667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27667"
},
{
"name": "CVE-2021-44151",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44151"
},
{
"name": "CVE-2023-30744",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30744"
},
{
"name": "CVE-2022-32244",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32244"
},
{
"name": "CVE-2023-30740",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30740"
},
{
"name": "CVE-2023-30743",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30743"
},
{
"name": "CVE-2021-44153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44153"
},
{
"name": "CVE-2022-39014",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39014"
},
{
"name": "CVE-2023-31404",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31404"
},
{
"name": "CVE-2023-30742",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30742"
},
{
"name": "CVE-2023-32113",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32113"
},
{
"name": "CVE-2023-28764",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28764"
},
{
"name": "CVE-2023-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29111"
},
{
"name": "CVE-2022-31596",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31596"
},
{
"name": "CVE-2023-31406",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31406"
},
{
"name": "CVE-2023-32112",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32112"
},
{
"name": "CVE-2023-32111",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32111"
},
{
"name": "CVE-2023-28762",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28762"
},
{
"name": "CVE-2021-44154",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44154"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0369",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-05-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP 2023-05-10 du 10 mai 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0301
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22,7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82,7.83, KERNEL 7.21, 7.22,7.49, 7.53, 7.73, 7.77, 7.81, 7.82 et 7.83 | ||
| SAP | N/A | SAP NetWeaver Process Integration version 7.50 | ||
| SAP | N/A | SAP Commerce versions 1905, 2005 et 2011 | ||
| SAP | N/A | SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application versions 600 et 700 | ||
| SAP | N/A | SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791 | ||
| SAP | N/A | SAP Landscape Management version 3.0 | ||
| SAP | N/A | SAP Application Interface Framework (ODATA service) versions 755 et 756 | ||
| SAP | N/A | SAP NetWeaver AS for ABAP (Business Server Pages) versions 700, 701, 702, 731, 740,750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430 | ||
| SAP | SAP NetWeaver AS Java | SAP NetWeaver AS Java for Deploy Service version 7.50 | ||
| SAP | N/A | SAP Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | N/A | SAP Application Interface Framework (Log Message View of Message Dashboard) versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E | ||
| SAP | N/A | SAP CRM versions 700, 701, 702, 712 et 713 | ||
| SAP | N/A | SapSetup (Software Installation Program) version 9.0 | ||
| SAP | N/A | SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) version 720 | ||
| SAP | N/A | SAP HCM Fiori App My Forms (Fiori 2.0) version 605 | ||
| SAP | NetWeaver Enterprise Portal | SAP NetWeaver Enterprise Portal version 7.50 | ||
| SAP | N/A | SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800 et 801 | ||
| SAP | N/A | SAP NetWeaver (BI CONT ADDON) versions 707, 737, 747 et 757 | ||
| SAP | N/A | SAP GUI for HTML versions KERNEL 7.22, 7.53, 7.547.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22 et 7.22EXT | ||
| SAP | N/A | SAP Application Interface Framework (Custom Hint of Message Dashboard Application versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E | ||
| SAP | N/A | SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791 | ||
| SAP | N/A | ABAP Platform and SAP Web Dispatcher versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89 et 7.91 | ||
| SAP | N/A | SAP Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP Web Dispatcher and Internet Communication Manager versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22,7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82,7.83, KERNEL 7.21, 7.22,7.49, 7.53, 7.73, 7.77, 7.81, 7.82 et 7.83",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Commerce versions 1905, 2005 et 2011",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application versions 600 et 700",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Landscape Management version 3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (ODATA service) versions 755 et 756",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS for ABAP (Business Server Pages) versions 700, 701, 702, 731, 740,750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS Java for Deploy Service version 7.50",
"product": {
"name": "SAP NetWeaver AS Java",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (Log Message View of Message Dashboard) versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM versions 700, 701, 702, 712 et 713",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SapSetup (Software Installation Program) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) version 720",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP HCM Fiori App My Forms (Fiori 2.0) version 605",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Enterprise Portal version 7.50",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800 et 801",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver (BI CONT ADDON) versions 707, 737, 747 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP GUI for HTML versions KERNEL 7.22, 7.53, 7.547.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22 et 7.22EXT",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Application Interface Framework (Custom Hint of Message Dashboard Application versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D et 75E",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP Platform and SAP Web Dispatcher versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89 et 7.91",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-24527",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24527"
},
{
"name": "CVE-2023-29185",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29185"
},
{
"name": "CVE-2023-29189",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29189"
},
{
"name": "CVE-2023-29109",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29109"
},
{
"name": "CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"name": "CVE-2023-27897",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27897"
},
{
"name": "CVE-2023-29187",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29187"
},
{
"name": "CVE-2022-41272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
},
{
"name": "CVE-2023-24528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24528"
},
{
"name": "CVE-2023-26458",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26458"
},
{
"name": "CVE-2023-29186",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29186"
},
{
"name": "CVE-2021-33683",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33683"
},
{
"name": "CVE-2023-27267",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27267"
},
{
"name": "CVE-2023-28763",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28763"
},
{
"name": "CVE-2023-29110",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29110"
},
{
"name": "CVE-2023-27499",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27499"
},
{
"name": "CVE-2023-28761",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28761"
},
{
"name": "CVE-2023-27269",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27269"
},
{
"name": "CVE-2023-27497",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27497"
},
{
"name": "CVE-2023-1903",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1903"
},
{
"name": "CVE-2023-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29111"
},
{
"name": "CVE-2023-29108",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29108"
},
{
"name": "CVE-2023-28765",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28765"
},
{
"name": "CVE-2023-29112",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29112"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0301",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 11 avril 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0228
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Authenticator pour Android version 1.3.0 | ||
| SAP | N/A | Business Objects Business Intelligence Platform (CMC) versions 420et 430 | ||
| SAP | N/A | NetWeaver AS pour ABAP et ABAP Platform (SAPRSBRO Program) versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | N/A | ABAP Platform versions 751, 753, 753, 754, 756, 757 et 791 | ||
| SAP | N/A | Solution Manager et ABAP managed systems(ST-PI) versions 2008_1_700, 2008_1_710 et 740 | ||
| SAP | N/A | NetWeaver versions 700, 701, 702, 731, 740 et 750 | ||
| SAP | N/A | NetWeaver AS pour ABAP et ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791 | ||
| SAP | N/A | NetWeaver AS pour ABAP et ABAP Platform versions SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791 | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform (Web Services) versions 420 et 430 | ||
| SAP | N/A | NetWeaver(SAP Enterprise Portal) versions 7.50 | ||
| SAP | N/A | NetWeaver AS Java (Object Analyzing Service) version 7.50 | ||
| SAP | NetWeaver Application Server pour ABAP | NetWeaver Application Server pour ABAP et ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791 | ||
| SAP | N/A | Content Server version 7.53 | ||
| SAP | N/A | Business Objects (Adaptive Job Server) versions 420 et 430 | ||
| SAP | N/A | NetWeaver AS pour Java version 7.50 | ||
| SAP | N/A | Host Agent version 7.22 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Authenticator pour Android version 1.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (CMC) versions 420et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS pour ABAP et ABAP Platform (SAPRSBRO Program) versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "ABAP Platform versions 751, 753, 753, 754, 756, 757 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Manager et ABAP managed systems(ST-PI) versions 2008_1_700, 2008_1_710 et 740",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver versions 700, 701, 702, 731, 740 et 750",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS pour ABAP et ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS pour ABAP et ABAP Platform versions SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Web Services) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver(SAP Enterprise Portal) versions 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java (Object Analyzing Service) version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server pour ABAP et ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 791",
"product": {
"name": "NetWeaver Application Server pour ABAP",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Content Server version 7.53",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects (Adaptive Job Server) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS pour Java version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Host Agent version 7.22",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-26459",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26459"
},
{
"name": "CVE-2023-27498",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27498"
},
{
"name": "CVE-2023-25616",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25616"
},
{
"name": "CVE-2023-27271",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27271"
},
{
"name": "CVE-2023-27896",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27896"
},
{
"name": "CVE-2023-25618",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25618"
},
{
"name": "CVE-2023-27501",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27501"
},
{
"name": "CVE-2023-26461",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26461"
},
{
"name": "CVE-2023-26460",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26460"
},
{
"name": "CVE-2023-23857",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23857"
},
{
"name": "CVE-2023-27895",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27895"
},
{
"name": "CVE-2023-0021",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0021"
},
{
"name": "CVE-2023-27270",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27270"
},
{
"name": "CVE-2023-25615",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25615"
},
{
"name": "CVE-2023-27269",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27269"
},
{
"name": "CVE-2023-27500",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27500"
},
{
"name": "CVE-2023-27893",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27893"
},
{
"name": "CVE-2023-26457",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26457"
},
{
"name": "CVE-2023-25617",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25617"
},
{
"name": "CVE-2023-27268",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27268"
},
{
"name": "CVE-2023-27894",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27894"
},
{
"name": "CVE-2023-24526",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24526"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0228",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 14 mars 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0125
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | SAPBASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790 et 791 | ||
| SAP | N/A | NetWeaver AS ABAP (Business Server Pages application) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G et 75H | ||
| SAP | N/A | BusinessObjects Business Intelligence (Web Intelligence UI) version 430 | ||
| SAP | N/A | BusinessObjects Business Intelligence platform (CMC) versions 420 et 430 | ||
| SAP | N/A | NetWeaver AS for ABAP and ABAP Platform version 740, 750, 751, 752, 753, 754, 755, 756, 757, 789 et 790 | ||
| SAP | N/A | CRM (WebClient UI) versions 700, 701, 702, 731, 740, 750, 751 et 752, WEBCUIF 748, 800 et 801, S4FND 102 et 103 | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789 et 790 | ||
| SAP | N/A | S/4 HANA (Map Treasury Correspondence Format Data) versions 104 et 105 | ||
| SAP | N/A | Host Agent Service versions 7.21 et 7.22 | ||
| SAP | N/A | Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600 | ||
| SAP | N/A | BusinessObjects Business Intelligence platform (Analysis edition for OLAP) versions 420 et 430 | ||
| SAP | N/A | NetWeaver AS ABAP (BSP Framework) version 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | N/A | NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751 et 752 | ||
| SAP | N/A | GRC Process Control application versions GRCFND_A V1200, V8100, GRCPINW V1100_700, V1100_731 et V1200_750 | ||
| SAP | N/A | Solution Manager (BSP Application) version 720 | ||
| SAP | N/A | Solution Manager version 720 | ||
| SAP | N/A | NetWeaver AS for ABAP and ABAP Platform version 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | N/A | NetWeaver AS for Java (Http Provider Service) version 7.50 | ||
| SAP | N/A | Business Planning and Consolidation versions SAP_BW 750, 751, 752, 753, 754, 755, 756 et 757, DWCORE 200 et 300 et CPMBPC 810 | ||
| SAP | N/A | NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | N/A | NetWeaver AS ABAP (BSP Framework) version 700, 701, 702, 731 et 740 | ||
| SAP | N/A | Business Client versions 6.5, 7.0 et 7.70 | ||
| SAP | N/A | Business Planning and Consolidation versions 200 et 300 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAPBASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790 et 791",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP (Business Server Pages application) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G et 75H",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence (Web Intelligence UI) version 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence platform (CMC) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for ABAP and ABAP Platform version 740, 750, 751, 752, 753, 754, 755, 756, 757, 789 et 790",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM (WebClient UI) versions 700, 701, 702, 731, 740, 750, 751 et 752, WEBCUIF 748, 800 et 801, S4FND 102 et 103",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789 et 790",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA (Map Treasury Correspondence Format Data) versions 104 et 105",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Host Agent Service versions 7.21 et 7.22",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) version 600",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence platform (Analysis edition for OLAP) versions 420 et 430",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP (BSP Framework) version 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751 et 752",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GRC Process Control application versions GRCFND_A V1200, V8100, GRCPINW V1100_700, V1100_731 et V1200_750",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Manager (BSP Application) version 720",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Solution Manager version 720",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for ABAP and ABAP Platform version 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for Java (Http Provider Service) version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Planning and Consolidation versions SAP_BW 750, 751, 752, 753, 754, 755, 756 et 757, DWCORE 200 et 300 et CPMBPC 810",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS ABAP (BSP Framework) version 700, 701, 702, 731 et 740",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Client versions 6.5, 7.0 et 7.70",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Planning and Consolidation versions 200 et 300",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-23854",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23854"
},
{
"name": "CVE-2023-0020",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0020"
},
{
"name": "CVE-2023-24529",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24529"
},
{
"name": "CVE-2023-23859",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23859"
},
{
"name": "CVE-2023-25614",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25614"
},
{
"name": "CVE-2023-24530",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24530"
},
{
"name": "CVE-2023-23851",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23851"
},
{
"name": "CVE-2023-23855",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23855"
},
{
"name": "CVE-2023-24523",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24523"
},
{
"name": "CVE-2023-24528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24528"
},
{
"name": "CVE-2023-0019",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0019"
},
{
"name": "CVE-2023-24525",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24525"
},
{
"name": "CVE-2023-23852",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23852"
},
{
"name": "CVE-2022-41264",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41264"
},
{
"name": "CVE-2023-23860",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23860"
},
{
"name": "CVE-2022-41268",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41268"
},
{
"name": "CVE-2023-23856",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23856"
},
{
"name": "CVE-2023-24521",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24521"
},
{
"name": "CVE-2023-24522",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24522"
},
{
"name": "CVE-2022-41262",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41262"
},
{
"name": "CVE-2023-23858",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23858"
},
{
"name": "CVE-2023-23853",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23853"
},
{
"name": "CVE-2023-0025",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0025"
},
{
"name": "CVE-2023-0013",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0013"
},
{
"name": "CVE-2023-0024",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0024"
},
{
"name": "CVE-2023-24524",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24524"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0125",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 14 f\u00e9vrier 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}
CERTFR-2023-AVI-0019
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Central management console) versions 420 et 430 | ||
| SAP | N/A | SAP NetWeaver AS for Java version 7.50 | ||
| SAP | N/A | SAP NetWeaver Process Integration version 7.50 | ||
| SAP | N/A | SAP NetWeaver ABAP Server et ABAP Platform versions SAP_BASIS 700, 701, 702,710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22 et 7.22EXT | ||
| SAP | N/A | SAP NetWeaver AS pour ABAP et ABAP Platform versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence platform (Analysis edition pour OLAP) versions 420 et 430 | ||
| SAP | N/A | SAP BPC MS 10.0 versions 800 et 810 | ||
| SAP | N/A | SAP Bank Account Management (Manage Banks) versions 800 et 900 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform (Central Management Console et BI Launchpad) versions 4.2 et 4.3 | ||
| SAP | N/A | SAP Host Agent (Windows) versions 7.21 et 7.22 | ||
| SAP | SAP BusinessObjects Business Intelligence | SAP BusinessObjects Business Intelligence Platform version 420 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SAP BusinessObjects Business Intelligence Platform (Central management console) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS for Java version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Process Integration version 7.50",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver ABAP Server et ABAP Platform versions SAP_BASIS 700, 701, 702,710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22 et 7.22EXT",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver AS pour ABAP et ABAP Platform versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756 et 757",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence platform (Analysis edition pour OLAP) versions 420 et 430",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BPC MS 10.0 versions 800 et 810",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Bank Account Management (Manage Banks) versions 800 et 900",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform (Central Management Console et BI Launchpad) versions 4.2 et 4.3",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP Host Agent (Windows) versions 7.21 et 7.22",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP BusinessObjects Business Intelligence Platform version 420",
"product": {
"name": "SAP BusinessObjects Business Intelligence",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-41203",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41203"
},
{
"name": "CVE-2023-0015",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0015"
},
{
"name": "CVE-2023-0022",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0022"
},
{
"name": "CVE-2022-41272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41272"
},
{
"name": "CVE-2022-41271",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41271"
},
{
"name": "CVE-2023-0014",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0014"
},
{
"name": "CVE-2023-0023",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0023"
},
{
"name": "CVE-2023-0012",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0012"
},
{
"name": "CVE-2023-0018",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0018"
},
{
"name": "CVE-2023-0017",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0017"
},
{
"name": "CVE-2023-0016",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0016"
},
{
"name": "CVE-2023-0013",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0013"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0019",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-01-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SAP du 10 janvier 2023",
"url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
}
]
}