SAP Security Patch Day, October 2021: the CVEs

SAP Security Patch Day October 2021: the CVEs SAP published on 12 October 2021, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Sep 2021, Aug 2021, Jul 2021, Jun 2021, May 2021, Apr 2021, Mar 2021, Feb 2021, Jan 2021, Dec 2020, Nov 2020, Oct 2020. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 7.5CVE-2021-40500EPSS 1.3%2021-10-12

   SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over …

2. 9.8CVE-2021-40499EPSS 1.2%2021-10-12

   Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker cou…

3. 5.5CVE-2021-40498EPSS 0.2%2021-10-12

   A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service,…

4. 5.3CVE-2021-40497EPSS 0.9%2021-10-12

   SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation coul…

5. 4.3CVE-2021-40496EPSS 0.9%2021-10-12

   SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to…

6. 5.3CVE-2021-40495EPSS 1.1%2021-10-12

   There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap …

7. 6.1CVE-2021-38183EPSS 0.7%2021-10-12

   SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to th…

8. 7.5CVE-2021-38181EPSS 1.1%2021-10-12

   SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

9. 9.8CVE-2021-38180EPSS 2.1%2021-10-12

   SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's com…

10. 4.9CVE-2021-38179EPSS 0.8%2021-10-12

    Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials.

11. 8.8CVE-2021-38178EPSS 1.3%2021-10-12

    The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the e…