SAP issued five new Security Notes this week as part of its December 2019 Security Patch Day, to which it also added 2 updates for previously released Security Notes.
All of the new Security Notes released this month are rated Medium priority and feature CVSS scores ranging between 6.7 and 4.3.
The first of these addresses CVE-2019-0402, an information disclosure in SAP Adaptive Server Enterprise, which impacts versions 15.7 and 16.0 of the application.
Next in line is a Security Note patching CVE-2019-0395, a Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), version 4.2.
The third new Security Note addresses CVE-2019-0405, CVE-2019-0403, and CVE-2019-0404, representing multiple security issues in SAP Enable Now release 1911.
SAP also patched CVE-2019-0399, a potential information disclosure in SAP Portfolio and Project Management versions S4CORE 102, 103, EPPM 100, CPRXRPM 500_702, 600_740, 610_740).
The last new Security Note in SAP’s December 2019 Security Patch Day fixes CVE-2019-0398, a Cross-Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform (Monitoring application), versions 4.1, 4.2, and 4.3.
The most important of the updated Security Notes is for a Hot News note released on April 2018 Patch Day, and which includes security fixes for the browser control delivered with SAP Business Client, version 6.5.
The second update released this month is for a Medium priority missing authorization check in SAP ERP HCM version 3, which is tracked as CVE-2019-0325.
According to Onapsis, a firm that specializes in securing Oracle and SAP products, six other Medium priority Security Notes should be added to the list, three new and three being updates to previously released Notes.
The most important of these is a Security Note titled “Upgrade SSL Support to TLSv1.2,” which affects SAP MDM customers. Additionally, SAP released four Security Notes covering missing authorization checks in ABAP components, Onapsis reveals.
Related: SAP Updates Four Hot News Notes on November 2019 Patch Day
Related: SAP Patches Critical Vulnerabilities With October 2019 Security Updates
