SAP Security Notes, February 2022
The central note 3131047 was updated with the addition of security notes 3142773 and 3139893 for the critical remote code execution vulnerability in the Apache Log4J 2 component. The new notes patch Log4Shell in SAP Commerce and SAP Dynamic Authorization Management and include manual procedures to apply both patches and workarounds.
Note 3140940 patches a code injection vulnerability in SAP Solution Manager due to missing segregation of duties in Root Cause Analysis (RCA) Tools. RCA supports central diagnostics and monitoring for SAP systems. Users with admin privileges are able to browse files and execute code through connected Diagnostics Agents. The note references note 3145008 for downloading the latest version of LM_SERVICE that contains the fix. It also references note 3137764 for removing links to the vulnerable applications.
Note 3140587 addresses a high-risk SQL injection vulnerability in the Workplace Server of NetWeaver Application Server ABAP. Note 3123427 provides a fix for a HTTP Request Smuggling vulnerability in SAP NetWeaver Application Server Java.