SAP Security

This page is dedicated to SAP Security issues that go beyond Users, Roles, Segregation of Duties and GRC. We continuously improve this section and ask you to visit often for the latest news or to subscribe to our Newsletter.

SAP Security Advisory

Please find the latest SAP Notes issued for SAP Security related issues. We urge our clients to take the time to read through all the notes upon release and act on the critical issues without delay to ensure that your data is safe.

The Business Application Security Initiative

The Business Application Security Initiative ( is a non-profit organization that focuses on security defects in business applications. These applications are the responsible for processing and managing the most critical business information and processes, which turns their protection into a key subject for private, governmental and defense organizations around the globe.

To these days, many security professionals believe that ERP security is a synonym of “Segregation of Duties”. While functional security is highly important, there are many other threats which imply higher levels of risk and are not usually properly assessed. The work of BIZEC is centered on risk rather than on technical details. This enables organizations to understand the impact of application security vulnerabilities and prioritize their mitigation accordingly.

The main goals of BIZEC are:

  • Raise awareness, demonstrating that ERP security must be analyzed holistically.
  • Analyze current and future threats affecting these systems.
  • Serve as a unique central point of knowledge and reference in this subject.
  • Provide experienced feedback to global Organizations, helping them to increase the security of their business-critical information.
  • Organize events with the community to share and exchange information.

BIZEC does not endorse or recommend commercial products or services with the objective of remaining as a vendor-independent community and provide the best available information free of commercial bounds and restrictions. Visit the BIZEC website for more information

Latest security vulnerabilities SAP products

Security vulnerability feeds by

Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516. (CVSS:4.3) (Last Update:2017-10-06)
Posted: September 28, 2017, 12:00 am
The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security Note 2389181. (CVSS:5.0) (Last Update:2017-10-03)
Posted: September 19, 2017, 12:00 am
An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and confirm email addresses that they do not have access to (candidate_hrobject is predictable and corr_act_guid is improperly validated). Furthermore, since an email address can be registered only once, an attacker could prevent other legitimate users from registering. This is SAP Security Note 2507798. (CVSS:5.0) (Last Update:2017-09-28)
Posted: September 17, 2017, 12:00 am
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. (CVSS:5.0) (Last Update:2017-08-28)
Posted: August 7, 2017, 12:00 am
SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592. (CVSS:7.5) (Last Update:2017-07-31)
Posted: July 25, 2017, 12:00 am
Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783. (CVSS:3.5) (Last Update:2017-08-26)
Posted: July 25, 2017, 12:00 am
Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script or HTML via the responsecode parameter to shp/shp_result.jsp, aka SAP Security Note 2308535. (CVSS:4.3) (Last Update:2017-07-28)
Posted: July 25, 2017, 12:00 am