Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Januari 2025
Diterbitkan pada 14 Januari 2025 · 13 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 14 Januari 2025 (Selasa kedua)
- Nota SAP
- 13
- Kritikal
- 2
- Tinggi
- 3
- CVSS tertinggi
- 9.9
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
13 nota dengan CVE SAP. 2 Kritikal dan 3 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 9.9.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform
Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform
DLL Hijacking vulnerability in SAPSetup
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 13 daripada 13
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3537476 | Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Kritikal | 9.9 | CVE-2025-0070 |
| 3550708 | Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Kritikal | 9.9 | CVE-2025-0066 |
| 3550816 | SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Tinggi | 8.8 | CVE-2025-0063 |
| 3474398 | Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform Baharu | SAP BusinessObjects BI Platform | Tinggi | 8.7 | CVE-2025-0060, CVE-2025-0061 |
| 3542533 | DLL Hijacking vulnerability in SAPSetup Baharu | SAPSetup | Tinggi | 7.8 | CVE-2025-0069 |
| 3542698 | Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow Baharu | SAP Business Workflow and SAP Flexible Workflow | Sederhana | 6.5 | CVE-2025-0058 |
| 3540108 | Missing Authorization check in SAP NetWeaver Application Server Java Baharu | SAP NetWeaver AS Java | Sederhana | 6.3 | CVE-2025-0067 |
| 3472837 | Information Disclosure vulnerability in SAP GUI for Windows Baharu | SAP GUI for Windows | Sederhana | 6.0 | CVE-2025-0055 |
| 3502459 | Information Disclosure vulnerability in SAP GUI for Java Baharu | SAP GUI for Java | Sederhana | 6.0 | CVE-2025-0056 |
| 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.0 | CVE-2025-0059 |
| 3536461 | Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 5.3 | CVE-2025-0053 |
| 3514421 | Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application) Baharu | SAP NetWeaver AS Java | Sederhana | 4.8 | CVE-2025-0057 |
| 3550674 | Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.3 | CVE-2025-0068 |