Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: September 2025
Diterbitkan pada 9 September 2025 · 19 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 9 September 2025 (Selasa kedua)
- Nota SAP
- 19
- Kritikal
- 3
- Tinggi
- 3
- CVSS tertinggi
- 10.0
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
19 nota dengan CVE SAP. 3 Kritikal dan 3 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 10.0.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)
Missing Authentication check in SAP NetWeaver
Insecure Storage of Sensitive Information in SAP Business One (SLD)
Missing input validation vulnerability in SAP Landscape Transformation Replication Server
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 19 daripada 19
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3670067 | Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4) Baharu | SAP Netweaver | Kritikal | 10.0 | CVE-2025-42944 |
| 3643865 | Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service) Baharu | SAP NetWeaver AS Java | Kritikal | 9.9 | CVE-2025-42922 |
| 3627373 | Missing Authentication check in SAP NetWeaver Baharu | SAP NetWeaver | Kritikal | 9.1 | CVE-2025-42958 |
| 3642961 | Insecure Storage of Sensitive Information in SAP Business One (SLD) Baharu | SAP Business One | Tinggi | 8.8 | CVE-2025-42933 |
| 3633002 | Missing input validation vulnerability in SAP Landscape Transformation Replication Server Baharu | SAP Landscape Transformation Replication Server | Tinggi | 8.1 | CVE-2025-42929 |
| 3635475 | Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise) Baharu | SAP S/4HANA | Tinggi | 8.1 | CVE-2025-42916 |
| 3614067 | Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation Baharu | SAP Business Planning and Consolidation | Sederhana | 6.5 | CVE-2025-42930 |
| 3635587 | Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) Baharu | SAP HCM | Sederhana | 6.5 | CVE-2025-42912, CVE-2025-42913, CVE-2025-42914 |
| 3643832 | Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application) Baharu | SAP HCM | Sederhana | 6.5 | CVE-2025-42917 |
| 3629325 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.1 | CVE-2025-42938 |
| 3647098 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management Baharu | SAP Supplier Relationship Management | Sederhana | 6.1 | CVE-2025-42920 |
| 3409013 | Missing Authorization Check in Fiori app (Manage Payment Blocks) Baharu | Fiori app | Sederhana | 5.4 | CVE-2025-42915 |
| 3619465 | Missing Authentication check in SAP NetWeaver Application Server Java Baharu | SAP NetWeaver AS Java | Sederhana | 5.3 | CVE-2025-42926 |
| 3627644 | Missing Authorization check in SAP NetWeaver (Service Data Download) Baharu | SAP NetWeaver | Sederhana | 5.0 | CVE-2025-42911 |
| 3450692 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups) Baharu | SAP Fiori | Sederhana | 4.3 | CVE-2025-42923 |
| 3540622 | Server-Side Request Forgery in SAP BI Platform BaharuDiterbitkan di luar Hari Tampalan | SAP BI Platform | Sederhana | 4.3 | CVE-2025-42907 |
| 3623504 | Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing) Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 4.3 | CVE-2025-42918 |
| 3640477 | Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service) Baharu | SAP NetWeaver AS Java | Sederhana | 4.3 | CVE-2025-42925 |
| 3525295 | Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service) Baharu | SAP NetWeaver AS Java | Rendah | 3.4 | CVE-2025-42927 |