The Center for Internet Security says dozens of vulnerabilities across SAP's business management products could let attackers take over affected systems, and it is urging organizations to install patches quickly.
The Center for Internet Security has issued an advisory covering a large batch of security flaws in SAP products, software many businesses and government agencies rely on to run operations like finance, sales, customer service, and human resources.
According to the Center for Internet Security, the most serious of these flaws could let an attacker run their own malicious code on an affected system, potentially giving them full control over it. That kind of access could let someone view, change, or steal sensitive data, or disrupt how the system works.
The affected products include SAP NetWeaver, the technology platform underlying many SAP business applications; SAP Web Dispatcher, which manages web traffic to SAP systems; SAP Gateway, which connects SAP data to outside applications; and several other SAP tools used for development, customer relationship management, and cloud services. The advisory lists dozens of individual vulnerabilities, ranging from code execution and authentication bypass issues to information leaks and service disruptions.
The Center for Internet Security notes there are currently no reports of these vulnerabilities being exploited in the wild, meaning no known attacks have used them yet.
This mostly affects organizations that run SAP software, not everyday computer users. The Center for Internet Security rates the risk as high for large and medium-sized businesses and government entities, medium for small organizations, and low for home users.
The Center for Internet Security recommends that organizations using these SAP products apply the vendor’s available updates as soon as possible, after testing them, and maintain an ongoing process for tracking and fixing software vulnerabilities on a regular schedule.
Based on a release from Center for Internet Security.
