Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Julai 2025
Diterbitkan pada 8 Julai 2025 · 27 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 8 Julai 2025 (Selasa kedua)
- Nota SAP
- 27
- Kritikal
- 5
- Tinggi
- 3
- CVSS tertinggi
- 9.9
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
27 nota dengan CVE SAP. 5 Kritikal dan 3 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 9.9.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)
Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network
Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer)
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 27 daripada 27
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3618955 | Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation) Baharu | SAP S/4HANA and SAP SCM | Kritikal | 9.9 | CVE-2025-42967 |
| 3610892 | Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service) Baharu | SAP NetWeaver | Kritikal | 9.1 | CVE-2025-42966 |
| 3620498 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network Baharu | SAP NetWeaver Enterprise Portal Federated Portal Network | Kritikal | 9.1 | CVE-2025-42980 |
| 3621236 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration Baharu | SAP NetWeaver Enterprise Portal Administration | Kritikal | 9.1 | CVE-2025-42964 |
| 3621771 | Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer) Baharu | SAP NetWeaver AS Java | Kritikal | 9.1 | CVE-2025-42963 |
| 3600846 | Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Tinggi | 8.1 | CVE-2025-42959 |
| 3623440 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Tinggi | 8.1 | CVE-2025-42953 |
| 3623255 | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis Baharu | SAP Business Warehouse and SAP Plug-In Basis | Tinggi | 7.7 | CVE-2025-42952 |
| 3595143 | Multiple Privilege Escalation Vulnerabilities in SAPCAR Baharu | SAPCAR | Sederhana | 6.9 | CVE-2025-42992, CVE-2025-43001 |
| 3596987 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.1 | CVE-2025-42969 |
| 3604212 | Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation) Baharu | SAP Business Warehouse | Sederhana | 6.1 | CVE-2025-42962 |
| 3617131 | Multiple vulnerabilities in SAP NetWeaver Application Server ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.1 | CVE-2025-42956, CVE-2025-42981 |
| 3617380 | Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench Baharu | SAP BusinessObjects Content Administrator workbench | Sederhana | 6.1 | CVE-2025-42985 |
| 3595156 | Directory Traversal vulnerability in SAPCAR Baharu | SAPCAR | Sederhana | 5.8 | CVE-2025-42970 |
| 3607513 | Insecure Key & Secret Management vulnerability in SAP GUI for Windows Baharu | SAP GUI for Windows | Sederhana | 5.6 | CVE-2025-42979 |
| 3540688 | Code Injection vulnerability in SAP FICA ODN framework BaharuDiterbitkan di luar Hari Tampalan | SAP FICA ODN framework | Sederhana | 5.5 | CVE-2025-42947 |
| 3606103 | Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report) Baharu | SAP Data Services | Sederhana | 5.4 | CVE-2025-42973 |
| 3621037 | Missing Authorization check in SAP NetWeaver (RFC enabled function module) Baharu | SAP NetWeaver | Sederhana | 5.0 | CVE-2025-42968 |
| 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.9 | CVE-2025-42961 |
| 3608991 | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools Baharu | SAP Business Warehouse and SAP BW/4HANA BEx Tools | Sederhana | 4.3 | CVE-2025-42960 |
| 3610056 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.3 | CVE-2025-42974 |
| 3626440 | Missing Authorization check in SAP NetWeaver and ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.3 | CVE-2025-42986 |
| 3573199 | HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Baharu | SAP BusinessObjects BI Platform | Sederhana | 4.1 | CVE-2025-31326 |
| 3598118 | Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application Baharu | SAP BusinessObjects BI Platform Central Management Console Promotion Management Application | Sederhana | 4.1 | CVE-2025-42965 |
| 3595141 | Memory Corruption vulnerability in SAPCAR Baharu | SAPCAR | Sederhana | 4.0 | CVE-2025-42971 |
| 3557179 | Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java Baharu | SAP NetWeaver AS Java | Rendah | 3.5 | CVE-2025-42978 |
| 3608156 | Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application) Baharu | SAP NetWeaver Business Warehouse | Rendah | 2.7 | CVE-2025-42954 |