SAP issued five new Security Notes this week as part of its December 2019 Security Patch Day, to which it also added 2 updates for previously released Security Notes.
All of the new Security Notes released this month are rated Medium priority and feature CVSS scores ranging between 6.7 and 4.3.
The first of these addresses CVE-2019-0402, an information disclosure in SAP Adaptive Server Enterprise, which impacts versions 15.7 and 16.0 of the application.
Next in line is a Security Note patching CVE-2019-0395, a Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), version 4.2.
The third new Security Note addresses CVE-2019-0405, CVE-2019-0403, and CVE-2019-0404, representing multiple security issues in SAP Enable Now release 1911.
SAP also patched CVE-2019-0399, a potential information disclosure in SAP Portfolio and Project Management versions S4CORE 102, 103, EPPM 100, CPRXRPM 500_702, 600_740, 610_740).
The last new Security Note in SAP’s December 2019 Security Patch Day fixes CVE-2019-0398, a Cross-Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform (Monitoring application), versions 4.1, 4.2, and 4.3.
The most important of the updated Security Notes is for a Hot News note released on April 2018 Patch Day, and which includes security fixes for the browser control delivered with SAP Business Client, version 6.5.
The second update released this month is for a Medium priority missing authorization check in SAP ERP HCM version 3, which is tracked as CVE-2019-0325.
According to Onapsis, a firm that specializes in securing Oracle and SAP products, six other Medium priority Security Notes should be added to the list, three new and three being updates to previously released Notes.
The most important of these is a Security Note titled “Upgrade SSL Support to TLSv1.2,” which affects SAP MDM customers. Additionally, SAP released four Security Notes covering missing authorization checks in ABAP components, Onapsis reveals.
Related: SAP Updates Four Hot News Notes on November 2019 Patch Day
Related: SAP Patches Critical Vulnerabilities With October 2019 Security Updates
More from Ionut Arghire
- Google Leads $16 Million Investment in Dope.security
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- CISA, NSA Issue Guidance for IAM Administrators
- Cisco Patches High-Severity Vulnerabilities in IOS Software
- ‘Nexus’ Android Trojan Targets 450 Financial Applications
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
Latest News
- Intel Co-founder, Philanthropist Gordon Moore Dies at 94
- Google Leads $16 Million Investment in Dope.security
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
