SAP Security Notes, September 2019
Hot News Note 2798336 patches a critical code injection vulnerability in NetWeaver Application Server for Java (AS Java). A program error in the Web Container of AS Java could enable attackers to bypass input validation and execute dynamic content such as malicious code. The note includes updates for the J2EE Engine and API components.
Note 2823733 includes an important update for Hot News Note 2808158. The note provides greater coverage for possible attack scenarios targeting an OS Command Injection vulnerability in the SAP Diagnostics Agent.
Note 2817491 addresses high priority denial of service and information disclosure vulnerabilities in SAP HANA Extended Application Services (Advanced Model). Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model) to overload the server or enumerate open internal network ports. The vulnerabilities have been fixed with SAP HANA Extended Application Services (Advanced model) version 1.0.118.