Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Februari 2025
Diterbitkan pada 11 Februari 2025 · 16 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 11 Februari 2025 (Selasa kedua)
- Nota SAP
- 16
- Kritikal
- 0
- Tinggi
- 4
- CVSS tertinggi
- 8.7
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
16 nota dengan CVE SAP. 0 Kritikal dan 4 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 8.7.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)
Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
Authentication bypass via authorization code injection in SAP Approuter
Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 16 daripada 16
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3525794 | Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console) Baharu | SAP BusinessObjects BI Platform | Tinggi | 8.7 | CVE-2025-0064 |
| 3567551 | Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) Baharu | SAP Supplier Relationship Management | Tinggi | 8.6 | CVE-2025-25243 |
| 3567974 | Authentication bypass via authorization code injection in SAP Approuter Baharu | SAP Approuter Node.js package | Tinggi | 8.1 | CVE-2025-24876 |
| 3563929 | Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services) Baharu | SAP HANA extended application services, advanced model | Tinggi | 7.1 | CVE-2025-24868 |
| 3555364 | SameSite Defense in Depth not applied for some cookies in SAP Commerce Baharu | SAP Commerce Cloud | Sederhana | 6.8 | CVE-2025-24875 |
| 3559510 | Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice Baharu | SAP Commerce Cloud | Sederhana | 6.8 | CVE-2025-24874 |
| 3445708 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad) Baharu | SAP BusinessObjects BI Platform | Sederhana | 6.1 | CVE-2025-24867 |
| 3562336 | Insecure Key & Secret Management vulnerability in SAP GUI for Windows Baharu | SAP GUI for Windows | Sederhana | 6.0 | CVE-2025-24870 |
| 3526203 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java Baharu | SAP NetWeaver AS Java | Sederhana | 5.4 | CVE-2025-0054 |
| 3532025 | Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests) Baharu | SAP Fiori Apps Reference Library | Sederhana | 5.4 | CVE-2025-25241 |
| 3546470 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 5.3 | CVE-2025-23187, CVE-2025-23189 |
| 3561264 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 5.3 | CVE-2025-23193 |
| 3547581 | Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.3 | CVE-2025-23190 |
| 3550027 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java Baharu | SAP NetWeaver AS Java | Sederhana | 4.3 | CVE-2025-24869 |
| 3553753 | Missing Authorization check in SAP ABAP Platform (ABAP Build Framework) Baharu | SAP ABAP Platform | Sederhana | 4.3 | CVE-2025-24872 |
| 3426825 | Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP Baharu | SAP Fiori for SAP ERP | Rendah | 3.1 | CVE-2025-23191 |