Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: April 2025
Diterbitkan pada 8 April 2025 · 20 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 8 April 2025 (Selasa kedua)
- Nota SAP
- 20
- Kritikal
- 4
- Tinggi
- 3
- CVSS tertinggi
- 10.0
- Diketahui dieksploitasi
- 1
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
20 nota dengan CVE SAP. 4 Kritikal dan 3 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 10.0. 1 nota membaiki CVE yang tersenarai dalam katalog CISA KEV.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
Authentication Bypass Vulnerability in SAP Financial Consolidation
Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 20 daripada 20
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3594142 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) BaharuDiterbitkan di luar Hari TampalanDiketahui dieksploitasi | SAP NetWeaver | Kritikal | 10.0 | CVE-2025-31324 |
| 3581961 | Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) Baharu | SAP S/4HANA | Kritikal | 9.9 | CVE-2025-27429 |
| 3587115 | Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) Baharu | SAP Landscape Transformation | Kritikal | 9.9 | CVE-2025-31330 |
| 3572688 | Authentication Bypass Vulnerability in SAP Financial Consolidation Baharu | SAP Financial Consolidation | Kritikal | 9.8 | CVE-2025-30016 |
| 3554667 | Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Tinggi | 8.5 | CVE-2025-23186 |
| 2927164 | Directory Traversal vulnerability in SAP Capital Yield Tax Management Baharu | SAP Capital Yield Tax Management | Tinggi | 7.7 | CVE-2025-30014 |
| 3581811 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Tinggi | 7.7 | CVE-2025-27428 |
| 3543274 | Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud) Baharu | SAP Commerce Cloud | Sederhana | 6.8 | CVE-2025-26654 |
| 3571093 | Code Injection vulnerability in SAP ERP BW Business Content Baharu | SAP ERP BW Business Content | Sederhana | 6.7 | CVE-2025-30013 |
| 3565751 | Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform Baharu | SAP BusinessObjects BI Platform | Sederhana | 6.6 | CVE-2025-31332 |
| 3568307 | Information Disclosure vulnerability in SAP KMC WPC Baharu | SAP KMC WPC | Sederhana | 5.3 | CVE-2025-26657 |
| 3559307 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.7 | CVE-2025-26653 |
| 3446649 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution) BaharuDiterbitkan di luar Hari Tampalan | SAP S/4HANA | Sederhana | 4.6 | CVE-2025-31328 |
| 3558864 | Missing Authorization check in SAP Solution Manager Baharu | SAP Solution Manager | Sederhana | 4.4 | CVE-2025-30017 |
| 3359825 | OData meta-data property entity tampering in SAP Field Logistics BaharuDiterbitkan di luar Hari Tampalan | SAP Field Logistics | Sederhana | 4.3 | CVE-2025-31327 |
| 3525971 | Odata meta-data tampering in SAP S4CORE entity Baharu | SAP S4CORE entity | Sederhana | 4.3 | CVE-2025-31333 |
| 3568778 | Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.3 | CVE-2025-27437 |
| 3577131 | Authorization Bypass vulnerability in SAP NetWeaver Baharu | SAP NetWeaver | Sederhana | 4.3 | CVE-2025-31331 |
| 3539465 | Information Disclosure Vulnerability in SAP Commerce Cloud Baharu | SAP Commerce Cloud | Sederhana | 4.2 | CVE-2025-27435 |
| 3565944 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.1 | CVE-2025-30015 |