Application Development Blog Posts
Learn and share on deeper, cross technology development topics such as integration and connectivity, automation, cloud extensibility, developing at scale, and security.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

SAP Security Patch Day - April 2017

Former Member
‎2017 Apr 11 6:27 AM
0 Kudos
7,988

This post by SAP Product Security Response Team shares information on Patch Day Security Notes* that are released on second Tuesday of every month and fix vulnerabilities discovered in SAP products. SAP strongly recommends that customers visit the Support Portal and apply patches on a priority to protect their SAP landscape.


On 11th of April 2017, SAP Security Patch Day saw the release of 12 security notes. Additionally, there were 3 updates to previously released security notes.

April Patch Day also comprises of a Security Note 2419592 of Very High priority (Hot News). As always, we recommend that customers apply all SAP Security Notes at the earliest.

List of security notes released on the April Patch Day:




































































































Note#

Title

Priority

CVSS
2419592 Code Injection vulnerability in TREX / BWA Very High 9.4
2407616 Update to Security Note released on Mar 2017 Patch Day:
Remote Code Execution vulnerability in SAP GUI for Windows		 High 8.0
2391018 Update to Security Note released on Feb 2017 Patch Day:
Memory Corruption vulnerability in SAP 3D Visual Enterprise Author, Generator and Viewer		 High 7.8
2410082 Missing XML Validation vulnerability in Web Dynpro Flash Island High 7.5
2421287 Security vulnerabilities in SAPLPD High 7.5
2406783 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Central Technical Configuration Medium 6.3
2423486 Missing Authorization check in SAP NetWeaver ADBC Demo Programs Medium 6.3
2427949 Incorrect Authorization Checks in SAP ERP Logistics Customer Master and Vendor Master Medium 6.3
2308535 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Java Archiving Framework Medium 6.1
2400292 Missing XML Validation vulnerability in TranslationSupport application Medium 5.4
2426076 Multiple vulnerabilities in SAP ERP Stakeholder Relationship Management Medium 5.3
2372301 Missing XML Validation in Composite Application Framework Authorization Tool Medium 4.9
2387249 Missing XML Validation vulnerability in Knowledge Management ICE Service Medium 4.9
2374348 Update to Security Note released on Jan 2017 Patch Day:
Information Disclosure in DBISQL affecting SAP SQL Anywhere, SAP ASE and SAP IQ		 Low 3.9
2403010 Cross-Site Request Forgery (CSRF) vulnerability in BI LaunchPad Low 3.5

 

Security Notes vs Vulnerability Types- April 2017


 

Security Notes vs Priority Distribution (November 2016 - April 2017)**


* Patch Day Security Notes are all notes that appear under the category of "Patch Day Notes" in SAP Support Portal

** Any Patch Day Security Note released after the second Tuesday, will be accounted for in the following SAP Security Patch Day.

Customers who would like to take a look at all Security Notes that are published or updated after the previous Patch Day see: https://support.sap.com/securitynotes -> All Security Notes -> Filter for notes which have been published after 14th March 2017.

To know more about the security researchers and research companies who have contributed for security patches of this month visit SAP Product Security Response Acknowledgement Page

Do write to us at secure@sap.com with all your comments and feedback on this blog post.

SAP Product Security Response Team
Labels in this area
Popular Blog Posts