Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Mei 2025
Diterbitkan pada 13 Mei 2025 · 16 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 13 Mei 2025 (Selasa kedua)
- Nota SAP
- 16
- Kritikal
- 2
- Tinggi
- 3
- CVSS tertinggi
- 10.0
- Diketahui dieksploitasi
- 1
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
16 nota dengan CVE SAP. 2 Kritikal dan 3 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 10.0. 1 nota membaiki CVE yang tersenarai dalam katalog CISA KEV.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)
Missing Authorization Check in SAP Landscape Transformation (PCL Basis)
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 16 daripada 16
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3578900 | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) Baharu | SAP Supplier Relationship Management | Kritikal | 10.0 | CVE-2025-30009, CVE-2025-30010, CVE-2025-30011, CVE-2025-30012, CVE-2025-30018 |
| 3604119 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) BaharuDiketahui dieksploitasi | SAP NetWeaver | Kritikal | 9.1 | CVE-2025-42999 |
| 3600859 | Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL)) Baharu | SAP S/4HANA Cloud Private Edition or on Premise | Tinggi | 8.3 | CVE-2025-43010 |
| 3586013 | Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW) Baharu | SAP BusinessObjects BI Platform | Tinggi | 7.9 | CVE-2025-43000 |
| 3591978 | Missing Authorization Check in SAP Landscape Transformation (PCL Basis) Baharu | SAP Landscape Transformation | Tinggi | 7.7 | CVE-2025-43011 |
| 3577300 | Information Disclosure vulnerability in SAP Gateway Client Baharu | SAP Gateway Client | Sederhana | 6.6 | CVE-2025-42997 |
| 3596033 | Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise) Baharu | SAP S/4HANA | Sederhana | 6.4 | CVE-2025-43003 |
| 2491817 | Missing Authorization check in SAP Service Parts Management (SPM) Baharu | SAP Service Parts Management | Sederhana | 6.3 | CVE-2025-43009 |
| 2719724 | Missing Authorization check in SAP Service Parts Management (SPM) Baharu | SAP Service Parts Management | Sederhana | 6.3 | CVE-2025-43007 |
| 3577287 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.2 | CVE-2025-31329 |
| 3588455 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) Baharu | SAP Supplier Relationship Management | Sederhana | 6.1 | CVE-2025-43006 |
| 3585992 | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal Baharu | SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal | Sederhana | 5.8 | CVE-2025-43008 |
| 3571096 | Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard) Baharu | SAP Digital Manufacturing | Sederhana | 5.3 | CVE-2025-43004 |
| 3558755 | Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console Baharu | SAP Data Services Management Console | Sederhana | 4.4 | CVE-2025-26662 |
| 3227940 | Missing Authorization check in SAP S4/HANA (OData meta-data property) Baharu | SAP S/4HANA | Sederhana | 4.3 | CVE-2025-43002 |
| 3574520 | Information Disclosure vulnerability in SAP GUI for Windows Baharu | SAP GUI for Windows | Sederhana | 4.3 | CVE-2025-43005 |