SAP Security Patch Day, January 2020: the CVEs

SAP Security Patch Day January 2020: the CVEs SAP published on 14 January 2020, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Dec 2019, Nov 2019, Oct 2019, Sep 2019, Aug 2019, Jul 2019, Jun 2019, May 2019, Apr 2019, Mar 2019, Feb 2019, Jan 2019. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 4.3CVE-2020-6307EPSS 0.7%2020-01-14

   Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks leading to the reading of sensitive information.

2. 2.7CVE-2020-6306EPSS 0.6%2020-01-14

   Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17).

3. 6.1CVE-2020-6305EPSS 0.8%2020-01-14

   PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

4. 7.5CVE-2020-6304EPSS 1.5%2020-01-14

   Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an atta…

5. 5.4CVE-2020-6303EPSS 0.5%2020-01-14

   SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.