SAP Security Notes, December 2024
Hot news note 3536965 addresses multiple high risk vulnerabilities in Adobe Document Services (ADS) of SAP NetWeaver Application Server for JAVA (AS Java). This includes vulnerabilities for Server-Side Request Forgery (SSRF) and information disclosure. ADS should be updated to the recommended patch levels detailed in the note. There are no workarounds provided by SAP.
Note 3542543 deals with a SSRF vulnerability in the NetWeaver Administrator of AS Java. The vulnerability is caused by insufficient authentication checks for a specific servlet. The note includes details for disabling the servlet as a workaround.
Note 3520281 was re-released with updated information for a cross-site scripting vulnerability in SAP Web Dispatcher. The note includes several workarounds if Web Dispatchers and Kernels cannot be upgraded to the recommended patch levels within a reasonable timeframe.
Note 3469791 patches an information disclosure vulnerability that could lead to the compromise of credentials for RFC destinations in SAP NetWeaver Application Server ABAP (AS ABAP). The vulnerability can be mitigated by setting profile parameter rfc/dynamic_dest_api_only to the value 1. This will deactivate the legacy dynamic destination.
Finally, note 3504390 addresses a NULL Pointer Dereference (NPD) vulnerability in AS ABAP that can be exploited by attackers to trigger a denial of service.