SAP SE Vulnerabilities and Affected Products
Vulnerabilities associated with SAP S/4HANA.
Products
Clear product- SAP 3D Visual Enterprise Viewer127 vulnerabilities
- SAP 3D Visual Enterprise Author27 vulnerabilities
- SAP Business One18 vulnerabilities
- SAP Disclosure Management13 vulnerabilities
- SAP Internet Graphics Server13 vulnerabilities
- SAP Business Objects Business Intelligence Platform12 vulnerabilities
- SAP HANA Extended Application Services12 vulnerabilities
- SAP Commerce10 vulnerabilities
- SAP Enable Now10 vulnerabilities
- SAP NetWeaver Enterprise Portal10 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform9 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)9 vulnerabilities
- SAP Adaptive Server Enterprise7 vulnerabilities
- SAP Financial Consolidation7 vulnerabilities
- SAP Internet Graphics Service7 vulnerabilities
- SAP NetWeaver AS ABAP7 vulnerabilities
- SAP NetWeaver AS ABAP and ABAP Platform7 vulnerabilities
- SAP Cloud Connector6 vulnerabilities
- SAP HANA6 vulnerabilities
- SAP S/4HANA6 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform (BI Workspace)5 vulnerabilities
- SAP Commerce Cloud5 vulnerabilities
- SAP Host Agent5 vulnerabilities
- SAP NetWeaver (ABAP Server) and ABAP Platform5 vulnerabilities
- SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-32248MEDIUM | Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data. CWE-20Jul 12, 2022 | CVSS5.3v3.1 | EPSS0.632% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-31597MEDIUM | Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data. CWE-862Jul 12, 2022 | CVSS5.4v3.1 | EPSS0.424% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-22531HIGH | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified. Jan 14, 2022 | CVSS8.1v3.1 | EPSS0.849% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-22530HIGH | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application. Jan 14, 2022 | CVSS8.1v3.1 | EPSS0.935% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-33701CRITICAL | DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability. CWE-89Sep 15, 2021 | CVSS9.1v3.1 | EPSS2.08% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-38176HIGH | Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system. | CVSS8.8v3.1 | EPSS1.27% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |