Vulnerabilitycritical
SAP April 2018 Security Patch Day address critical flaws in web browser controls in SAP Business Client
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2009-3960 | Information Disclosure in Adobe BlazeDS (Used by LiveCycle and ColdFusion) | — | 90% | KEVRansomware | — KEV |
| CVE-2017-7668 | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the… | 7.5 | 57% | ||
CVE-2018-2404+3 related CVEs | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation | 9.8 group max | 2% | ||
| CVE-2018-2405 | SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to… | 5.4 | <1% | ||
| CVE-2018-2406 | Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path | 5.3 | <1% | ||
| CVE-2018-2408 | Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad | 7.3 | 2% | ||
| CVE-2018-2409 | Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector) | 8.8 | 1% | ||
| CVE-2018-2410 | SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability | 5.4 | <1% |
From the original article
4 min read at securityaffairs.com
SAP released the April 2018 Security Patch Day, a collection of ten security patches that also address critical vulnerabilities in web browser controls in SAP Business Client. SAP also released 2 updates to previously released security notes, one note was rated Hot News, 4 were rated High Priority, and 7 were rated Medium Priority. Below the list of security notes released on the April 2018 Security Patch Day:
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.