SAP Security

This page is dedicated to SAP Security issues that go beyond Users, Roles, Segregation of Duties and GRC. We continuously improve this section and ask you to visit often for the latest news or to subscribe to our Newsletter.

SAP Security Advisory

Please find the latest SAP Notes issued for SAP Security related issues. We urge our clients to take the time to read through all the notes upon release and act on the critical issues without delay to ensure that your data is safe.

The Business Application Security Initiative

The Business Application Security Initiative (BIZEC.org) is a non-profit organization that focuses on security defects in business applications. These applications are the responsible for processing and managing the most critical business information and processes, which turns their protection into a key subject for private, governmental and defense organizations around the globe.

To these days, many security professionals believe that ERP security is a synonym of “Segregation of Duties”. While functional security is highly important, there are many other threats which imply higher levels of risk and are not usually properly assessed. The work of BIZEC is centered on risk rather than on technical details. This enables organizations to understand the impact of application security vulnerabilities and prioritize their mitigation accordingly.

The main goals of BIZEC are:

  • Raise awareness, demonstrating that ERP security must be analyzed holistically.
  • Analyze current and future threats affecting these systems.
  • Serve as a unique central point of knowledge and reference in this subject.
  • Provide experienced feedback to global Organizations, helping them to increase the security of their business-critical information.
  • Organize events with the community to share and exchange information.

BIZEC does not endorse or recommend commercial products or services with the objective of remaining as a vendor-independent community and provide the best available information free of commercial bounds and restrictions. Visit the BIZEC website for more information

Latest security vulnerabilities SAP products

Security vulnerability feeds by http://www.cvedetails.com

SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting. (CVSS:3.5) (Last Update:2018-05-16)
Posted: April 10, 2018, 12:00 am
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. (CVSS:6.5) (Last Update:2018-05-14)
Posted: April 10, 2018, 12:00 am
Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an authorized user to get SAP Disclosure Management to point a specific chapter type to a chapter the user has not been given access to. (CVSS:4.0) (Last Update:2018-05-17)
Posted: April 10, 2018, 12:00 am
SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability. (CVSS:3.5) (Last Update:2018-05-16)
Posted: April 10, 2018, 12:00 am
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. (CVSS:6.5) (Last Update:2018-05-14)
Posted: April 10, 2018, 12:00 am
SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. (CVSS:7.5) (Last Update:2018-05-14)
Posted: April 10, 2018, 12:00 am
In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system. (CVSS:3.5) (Last Update:2018-04-13)
Posted: March 14, 2018, 12:00 am