SAP Security Patch Day, January 2018: the CVEs

SAP Security Patch Day January 2018: the CVEs SAP published on 9 January 2018, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Dec 2017, Nov 2017, Oct 2017, Sep 2017, Aug 2017, Jul 2017, Jun 2017, May 2017, Apr 2017, Mar 2017, Feb 2017, Jan 2017. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 8.8CVE-2018-2363EPSS 1.7%2018-01-09

   SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour …

2. 5.3CVE-2018-2362EPSS 1.6%2018-01-09

   A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname.

3. 8.8CVE-2018-2361EPSS 1.2%2018-01-09

   In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for configuring the BPO tools.

4. 7.5CVE-2018-2360EPSS 2.5%2018-01-09

   SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system storage.