SAP Security Patch Day, May 2021: the CVEs

SAP Security Patch Day May 2021: the CVEs SAP published on 11 May 2021, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Apr 2021, Mar 2021, Feb 2021, Jan 2021, Dec 2020, Nov 2020, Oct 2020, Sep 2020, Aug 2020, Jul 2020, Jun 2020, May 2020. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 6.5CVE-2021-27619EPSS 0.8%2021-05-11

   SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iterative…

2. 4.9CVE-2021-27618EPSS 0.8%2021-05-11

   The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from local source. An attacker could craft a malicious file and u…

3. 4.9CVE-2021-27617EPSS 0.8%2021-05-11

   The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when u…

4. 7.8CVE-2021-27616EPSS 0.3%2021-05-11

   Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access informat…

5. 7.1CVE-2021-27614EPSS 0.3%2021-05-11

   SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the …

6. 7.8CVE-2021-27613EPSS 0.3%2021-05-11

   Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information…

7. 6.1CVE-2021-27612EPSS 0.6%2021-05-11

   In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim.

8. 6.7CVE-2021-27611EPSS 0.3%2021-05-11

   SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to da…