Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

SAP Releases 5 Security Notes on December 2019 Patch Day

SAP issued five new Security Notes this week as part of its December 2019 Security Patch Day, to which it also added 2 updates for previously released Security Notes.

All of the new Security Notes released this month are rated Medium priority and feature CVSS scores ranging between 6.7 and 4.3. 

SAP issued five new Security Notes this week as part of its December 2019 Security Patch Day, to which it also added 2 updates for previously released Security Notes.

All of the new Security Notes released this month are rated Medium priority and feature CVSS scores ranging between 6.7 and 4.3. 

The first of these addresses CVE-2019-0402, an information disclosure in SAP Adaptive Server Enterprise, which impacts versions 15.7 and 16.0 of the application. 

Next in line is a Security Note patching CVE-2019-0395, a Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), version 4.2. 

The third new Security Note addresses CVE-2019-0405, CVE-2019-0403, and CVE-2019-0404, representing multiple security issues in SAP Enable Now release 1911. 

SAP also patched CVE-2019-0399, a potential information disclosure in SAP Portfolio and Project Management versions S4CORE 102, 103, EPPM 100, CPRXRPM 500_702, 600_740, 610_740). 

The last new Security Note in SAP’s December 2019 Security Patch Day fixes CVE-2019-0398, a Cross-Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform (Monitoring application), versions 4.1, 4.2, and 4.3. 

The most important of the updated Security Notes is for a Hot News note released on April 2018 Patch Day, and which includes security fixes for the browser control delivered with SAP Business Client, version 6.5. 

Advertisement. Scroll to continue reading.

The second update released this month is for a Medium priority missing authorization check in SAP ERP HCM version 3, which is tracked as CVE-2019-0325

According to Onapsis, a firm that specializes in securing Oracle and SAP products, six other Medium priority Security Notes should be added to the list, three new and three being updates to previously released Notes. 

The most important of these is a Security Note titled “Upgrade SSL Support to TLSv1.2,” which affects SAP MDM customers. Additionally, SAP released four Security Notes covering missing authorization checks in ABAP components, Onapsis reveals.

Related: SAP Updates Four Hot News Notes on November 2019 Patch Day

Related: SAP Patches Critical Vulnerabilities With October 2019 Security Updates

Related: SAP Patches Critical Vulnerability in NetWeaver

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.