Security · High impactFan score 65 · Tier A
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
The Hacker News ·
The Brief
- SAP fixed four flaws rated CVSS 10.0, the maximum score, as part of its monthly Security Patch Day.
- The flaws can be exploited without logging in.
- Three flaws are in the SAP NetWeaver application server; the fourth is in a product the source text does not name, and two of the four enable remote code execution.
Why it matters
Unauthenticated flaws rated at the maximum CVSS score, including remote code execution, can give attackers control of SAP systems if they are not patched.
Who’s affected
- Teams running SAP NetWeaver application server
- Organisations running SAP systems
What to do
- Apply SAP's Security Patch Day fixes for the four CVSS 10.0 flaws
- #sap
- #security
- #vulnerability
- #patch
- #netweaver
- #remote-code-execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the…
Timeline
SAP fixed four CVSS 10.0 flaws as part of its monthly Security Patch Day
The Hacker News
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution