SAP Security Patch Day, September 2018: the CVEs

SAP Security Patch Day September 2018: the CVEs SAP published on 11 September 2018, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Aug 2018, Jul 2018, Jun 2018, May 2018, Apr 2018, Mar 2018, Feb 2018, Jan 2018, Dec 2017, Nov 2017, Oct 2017, Sep 2017. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 7.5CVE-2018-2465EPSS 2.6%2018-09-11

   SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hacker can cause the database server to crash.

2. 6.1CVE-2018-2464EPSS 1.3%2018-09-11

   SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.

3. 8.6CVE-2018-2463EPSS 1.6%2018-09-11

   The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC.

4. 8.8CVE-2018-2462EPSS 1.6%2018-09-11

   In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source.

5. 8.8CVE-2018-2461EPSS 1.3%2018-09-11

   Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escalation of privileges.

6. 5.9CVE-2018-2460EPSS 0.8%2018-09-11

   SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack.

7. 7.5CVE-2018-2459EPSS 1.7%2018-09-11

   Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data values of a different user.

8. 7.5CVE-2018-2458EPSS 1.7%2018-09-11

   Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access information which would otherwise be restricted.

9. 6.5CVE-2018-2457EPSS 0.9%2018-09-11

   Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherwise be restricted.

10. 8.8CVE-2018-2455EPSS 1.3%2018-09-11

    SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_SEPA) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

11. 8.8CVE-2018-2454EPSS 1.3%2018-09-11

    SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

12. 6.1CVE-2018-2452EPSS 1.4%2018-09-11

    The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability.