SAP Security Patch Day, December 2021: the CVEs

SAP Security Patch Day December 2021: the CVEs SAP published on 14 December 2021, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Nov 2021, Oct 2021, Sep 2021, Aug 2021, Jul 2021, Jun 2021, May 2021, Apr 2021, Mar 2021, Feb 2021, Jan 2021, Dec 2020. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 6.7CVE-2021-44235EPSS 0.3%2021-12-14

   Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when e…

2. 8.8CVE-2021-44233EPSS 0.8%2021-12-14

   SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.

3. 7.7CVE-2021-44232EPSS 1.0%2021-12-14

   SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot …

4. 9.8CVE-2021-44231EPSS 1.3%2021-12-14

   Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

5. 3.3CVE-2021-42070EPSS 0.6%2021-12-14

   When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the ap…

6. 3.3CVE-2021-42069EPSS 1.1%2021-12-14

   When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of t…

7. 3.3CVE-2021-42068EPSS 0.6%2021-12-14

   When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.

8. 4.4CVE-2021-42066EPSS 0.4%2021-12-14

   SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth application knowledge is required, but …

9. 9.8CVE-2021-42064EPSS 1.1%2021-12-14

   If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exp…

10. 6.1CVE-2021-42063ExploitEPSS 23%2021-12-14

    A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead t…

11. 5.4CVE-2021-42061EPSS 0.5%2021-12-14

    SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retri…