April 2021 Security Patch Day fixes a critical flaw in SAP Commerce
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-26832 | SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable. NVD description · AI analysis pending | 7.6 | 2% | PoC ×2 |
| — | |
| CVE-2021-21481 | The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability. NVD description · AI analysis pending | 8.8 | <1% |
| — | ||
| CVE-2021-21482 | SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password us SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed. NVD description · AI analysis pending | 8.3 | <1% |
| — | ||
| CVE-2021-21483 | Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct seriou Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serious impact beyond the exploitable component thereby affecting the confidentiality in the application. NVD description · AI analysis pending | 4.9 | <1% |
| — | ||
| CVE-2021-21485 | An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacke An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user. NVD description · AI analysis pending | 6.5 | <1% |
| — | ||
| CVE-2021-27602 | SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to dro SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application. NVD description · AI analysis pending | 9.9 | 2% |
| — | ||
| CVE-2021-27608 | An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable fil An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable file is registered. This could further lead to complete compromise of confidentiality, Integrity and Availability. NVD description · AI analysis pending | 7.5 | <1% |
| — |
Full article540 words · extracted from securityaffairs.com · click to collapse
April 2021 Security Patch Day includes 14 new security notes and 5 updates to previously released notes, one of them fixes a critical issue in SAP Commerce.
April 2021 Security Patch Day includes 14 new security notes and 5 updates to previously released ones, among the issues addressed by the software giant there is a critical flaw in SAP Commerce.
“Similar to SAP’s February Patch Day, the only HotNews note besides the regularly recurring SAP Business Client note #2622660 and the minor update of HotNews #3022422 note, fixes a vulnerability in the Rules Engine of SAP Commerce. SAP Security Note #3040210, tagged with a CVSS score of 9.9 describes that certain authorized users of the SAP Commerce Backoffice application can exploit the scripting capabilities of the Rules engine to inject malicious code in the source rules. This can lead to a remote code execution with critical impact on the system’s confidentiality, integrity, and availability.” reads the advisory published by SAP security firm Onapsis.
The critical vulnerability, tracked as CVE-2021-27602, could be exploited by remote attackers to execute arbitrary code on vulnerable installs, it was rated with a CVSS score of 9.9.
The issue is described as a Remote Code Execution vulnerability in Source Rules of SAP Commerce, could allow authorized users of the SAP Commerce Backoffice software to inject malicious code in source rules leveraging the scripting capabilities of the Rules engine.
The issue affects SAP Commerce versions 1808, 1811, 1905, 2005, 2011.
“Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application.” reads the advisory published by NIST. “An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.”
April 2021 Security Patch Day includes two other Hot News security notes, which are updates to previously released notes.
The first one updates the Security Note released on August 2018 Patch Day, it includes security updates for the browser control Google Chromium delivered with SAP Business Client. The critical issue received a CVSS score of 10, t impacts Product – SAP Business Client, Version 6.5.
The second one updates the Security Note released on March 2021 Patch Day, it addresses a Missing Authorization Check in SAP NetWeaver AS JAVA tracked as CVE-2021-21481.
The flaw impacts SAP NetWeaver AS JAVA (MigrationService), Versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50.
The company also released security notes for four high-severity vulnerabilities, three of them are classified as information disclosure issues respectively impacting NetWeaver Master Data Management (CVE-2021-21482), Solution Manager (CVE-2021-21483), and NetWeaver AS for Java (CVE-2021-21485), and an unquoted service path in SAPSetup (CVE-2021-27608).
SAP also released an update for a high-severity note addressing a missing authorization check in NetWeaver AS ABAP and S4 HANA (SAP Landscape Transformation) tracked CVE-2020-26832.
The complete list of security notes released as part of SAP Security Patch Day – April 2021 is available here.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SAP Commerce)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/116854/security/sap-commerce-critical-flaw.html