SAP Patch Day – July 2019 addresses a critical flaw in Diagnostics Agent
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0281 | SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site S SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. NVD description · AI analysis pending | 6.1 | 1% |
| — | ||
| CVE-2019-0327 +1 in the same advisory: …0318 | SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7. SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation. NVD description · AI analysis pending | 7.2 group max | 2% |
| — | ||
| CVE-2019-0319 | The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not. NVD description · AI analysis pending | 7.5 | 3% | PoC ×2 |
| — | |
| CVE-2019-0321 | ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. NVD description · AI analysis pending | 6.1 | 1% |
| — | ||
| CVE-2019-0322 | SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate u SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. NVD description · AI analysis pending | 7.5 | 3% |
| — | ||
| CVE-2019-0325 | SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data. NVD description · AI analysis pending | 4.2 | <1% |
| — | ||
| CVE-2019-0326 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, res SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. NVD description · AI analysis pending | 6.1 | 1% |
| — | ||
| CVE-2019-0328 | ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands wit ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system. NVD description · AI analysis pending | 7.2 | 3% |
| — | ||
| CVE-2019-0329 | SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. NVD description · AI analysis pending | 6.1 | 1% |
| — | ||
| CVE-2019-0330 | The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application. NVD description · AI analysis pending | 9.1 | 2% |
| — |
Full article432 words · extracted from securityaffairs.com · click to collapse
SAP released 11 Security Notes as part of the Patch Day – July 2019, one of which was a Hot News Note addressing a critical flaw in Diagnostics Agent.
This month SAP released 11 Security Notes as part of the Patch Day – July 2019. One of them is a Hot News Note that addresses a critical vulnerability in Diagnostics Agent tracked as CVE-2019-0330.
The vulnerability is an OS command injection issue that could be exploited to fully compromise the SAP system, it received a CVSS score of 9.1.
The Diagnostics Agent is a central component of the SAP Solution Manager system landscape. It allows to manage monitoring and diagnostics events communications between every SAP system and Solution Manager that allows administrators to execute OS commands through a GAP_ADMIN transaction.
Each command is validated using a whitelist file that is present in the Diagnostic Agent installation directory. The CVE-2019-0330 flaw could be exploited by an attacker to bypass the validation process by sending a specially crafted payload.
“Using its basic functionality, a SolMan admin can execute OS commands through a GAP_ADMIN transaction, in order to perform analysis into an SAP system. Once executed, those commands are validated using a whitelist file located in the SMDAgent installation directory.” reads the analysis published by Onapsis. “This vulnerability may allow an attacker to bypass this validation by sending a custom-crafted payload. Using this technique the attacker could obtain full control over an SAP system compromising the SMDAgent user, allowing access sensitive information (such as credentials and critical business information), changing application configurations or even stopping SAP services.”
Experts pointed out that the SDMAgent must be installed in every SAP system for diagnostic purposes, this means that the extent of the attack is broad and could affect the entire landscape.
SAP also released a High priority Security Note that addresses a code injection flaw, tracked as CVE-2019-0328, that affects the ABAP Tests Modules of NetWeaver Process Integration.
The CVE-2019-0328 vulnerability received a CVSS score of 8.7.
The flaw resides in the Extended Computer Aided Test Tool (eCATT), a tool used to cover automatic testing in SAP business processes.
July 2019 Patch Day updates also address other 9 Medium severity flaws: Denial of service in Commerce Cloud (CVE-2019-0322), XSS in OpenUI5 (CVE-2019-0281), XSS in Information Steward (CVE-2019-0329), XSS in ABAP (CVE-2019-0321), XSS in SAP BusinessObjects (CVE-2019-0326), Unrestricted File Upload in NetWeaver (CVE-2019-0327), Missing Authorization check in ERP HCM (CVE-2019-0325), Information disclosure in NetWeaver (CVE-2019-0318), and Content Injection in Gateway (CVE-2019-0319).
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – SAP security, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/88396/security/sap-security-notes-july-2019.html