Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Mac 2025
Diterbitkan pada 11 Mac 2025 · 19 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 11 Mac 2025 (Selasa kedua)
- Nota SAP
- 19
- Kritikal
- 0
- Tinggi
- 2
- CVSS tertinggi
- 8.8
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
19 nota dengan CVE SAP. 0 Kritikal dan 2 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 8.8.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 19 daripada 19
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3563927 | Missing Authorization check in SAP NetWeaver (ABAP Class Builder) Baharu | SAP NetWeaver | Tinggi | 8.8 | CVE-2025-26661 |
| 3569602 | Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI) Baharu | SAP Commerce Cloud | Tinggi | 8.8 | CVE-2025-27434 |
| 3561045 | Broken Authentication in SAP Business One (Service Layer) Baharu | SAP Business One | Sederhana | 6.8 | CVE-2025-26658 |
| 3552824 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.1 | CVE-2025-26659 |
| 3562390 | Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.1 | CVE-2025-25242 |
| 3552144 | Missing Authorization Check in SAP Business Warehouse (Process Chains) Baharu | SAP Business Warehouse | Sederhana | 5.7 | CVE-2025-25244 |
| 3557469 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Baharu | SAP BusinessObjects BI Platform | Sederhana | 5.4 | CVE-2025-25245 |
| 3567246 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java Baharu | SAP NetWeaver AS Java | Sederhana | 5.4 | CVE-2025-27431 |
| 3561792 | Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component) Baharu | SAP NetWeaver Enterprise Portal | Sederhana | 5.3 | CVE-2025-23194 |
| 3558132 | Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager Baharu | SAP Web Dispatcher and Internet Communication Manager | Sederhana | 4.9 | CVE-2025-0071 |
| 3557459 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Baharu | SAP BusinessObjects BI Platform | Sederhana | 4.7 | CVE-2025-0062 |
| 3474392 | Missing Authorization check in S/4HANA (Manage Purchasing Info Records) Baharu | SAP S/4HANA | Sederhana | 4.3 | CVE-2025-26656 |
| 3557131 | Missing Authorization check in SAP S/4HANA (RBD) Baharu | SAP S/4HANA | Sederhana | 4.3 | CVE-2025-23188 |
| 3557655 | Broken Access Control in SAP Fiori apps (Posting Library) Baharu | SAP Fiori | Sederhana | 4.3 | CVE-2025-26660 |
| 3565835 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) Baharu | SAP S/4HANA | Sederhana | 4.3 | CVE-2025-27433, CVE-2025-27436 |
| 3549494 | Information Disclosure in SAP Business Objects Business Intelligence Platform Baharu | SAP BusinessObjects BI Platform | Sederhana | 4.1 | CVE-2025-23185 |
| 3561861 | Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center) Baharu | SAP CRM and SAP S/4HANA | Rendah | 3.5 | CVE-2025-27430 |
| 3347991 | Missing Authorization check in SAP JIT(Outbound) Baharu | SAP Just In Time | Rendah | 3.1 | CVE-2025-26655 |
| 3568865 | Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit) Baharu | SAP Electronic Invoicing for Brazil | Rendah | 2.4 | CVE-2025-27432 |