Yvan Genuer

**Name of the Vulnerable Software and Affected Versions** SAP Focused Run (Simple Diagnostics Agent 1.0) version 1.0 **Description** A highly privileged remote attacker can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information. **Recommendations** For SAP Focused Run (Simple Diagnostics Agent 1.0) version 1.0, consider restricting access to sensitive directories until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Simple Diagnostics Agent versions 1.0 through 1.57 **Description** The issue allows an attacker to access restricted information via a random port between 9000 and 65535. This enables information gathering that could potentially be used to exploit future security issues. **Recommendations** For versions 1.0 through 1.57, as a temporary workaround, consider restricting access to the random ports used by the Simple Diagnostics Agent to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP Fiori launchpad versions 754 through 756 **Description** The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. This allows for the execution of malicious scripts in the context of the affected application. **Recommendations** For versions 754 through 756, update to a version that includes the fix for this issue to prevent Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP Focused Run (Real User Monitoring) versions 200, 300 **Description** The issue is related to a Cross-Site Scripting (XSS) vulnerability. It occurs because the REST service does not sufficiently sanitize the input name of the file using multipart/form-data. This lack of proper sanitization can lead to security issues. **Recommendations** For versions 200 and 300, consider restricting access to the REST service until a proper fix is applied, focusing on sanitizing the input name of the file using multipart/form-data to prevent Cross-Site Scripting (XSS) attacks. As a temporary workaround, disabling the REST service or limiting its functionality can help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Simple Diagnostics Agent versions 1.0 up to version 1.57 **Description** The issue concerns the lack of authentication checks for functionalities accessible via localhost on http port 3005. This allows an attacker to access administrative or privileged functionalities, potentially reading, modifying, or deleting sensitive information and configurations. **Recommendations** For versions 1.0 up to version 1.57, consider restricting access to the http port 3005 to minimize the risk of exploitation. As a temporary workaround, limit the use of administrative functionalities until a proper authentication mechanism is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Portal versions 7.10 through 7.50 Description: The issue allows an unauthenticated attacker to craft a malicious URL which, when clicked by a user, can make any type of request (e.g., POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability. Recommendations: For SAP NetWeaver Portal versions 7.10 through 7.50, consider disabling the Iviews Editor component until a patch is available to prevent exploitation of the Server-Side Request Forgery (SSRF) vulnerability. Restrict access to internal and external servers to minimize the risk of data access or modification. Avoid using malicious URLs that can trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP NetWeaver Knowledge Management XML Forms versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50 **Description** The issue allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands. The attacker can copy this file into a location accessible by the system and then create a file that triggers the XSLT engine to execute the script contained within the malicious XSL file. This can result in a full compromise of the confidentiality, integrity, and availability of the system. **Recommendations** For SAP NetWeaver Knowledge Management XML Forms versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, consider disabling the XSLT engine or restricting access to it until a patch is available. As a temporary workaround, avoid using the XSLT functionality in the affected versions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SAP Web Dispatcher versions 7.49, 7.53, 7.77, 7.81 KRNL64NUC versions 7.22, 7.22EXT, 7.49 KRNL64UC versions 7.22, 7.22EXT, 7.49, 7.53 KERNEL versions 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 Description: The issue allows an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server, which may result in a back-end server confusing the boundaries of malicious and legitimate messages. This can lead to the back-end server executing a malicious payload, allowing the attacker to read or modify any information on the server or consume server resources, making it temporarily unavailable. Recommendations: For SAP Web Dispatcher versions 7.49, 7.53, 7.77, 7.81, update to a version that includes the fix for this issue. For KRNL64NUC versions 7.22, 7.22EXT, 7.49, update to a version that includes the fix for this issue. For KRNL64UC versions 7.22, 7.22EXT, 7.49, 7.53, update to a version that includes the fix for this issue. For KERNEL versions 7.22, 7.49, 7.53, 7.77, 7.81, 7.83, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the front-end server to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: SAP CommonCryptoLib versions 8.5.38 or lower Description: The issue is related to a null pointer dereference vulnerability. When an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network, it causes the SAP application to crash. This has a high impact on the availability of the SAP system. Recommendations: For SAP CommonCryptoLib versions 8.5.38 or lower, update to a version higher than 8.5.38 to resolve the issue. As a temporary workaround, consider restricting access to the SAP application to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Knowledge Management (affected versions not specified) Description: The issue allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Enterprise Portal versions 7.30 through 7.50 Description: The issue arises when the NetWeaver Enterprise Portal does not sufficiently encode URL parameters under certain conditions. This allows an attacker to craft a malicious link and send it to a victim, resulting in a Reflected Cross-Site Scripting (XSS) issue. An attacker can exploit this by sending a crafted link to a victim, potentially leading to malicious script execution. Recommendations: For versions 7.30 through 7.50, update to a version that includes the fix for the encoding issue to prevent Reflected Cross-Site Scripting (XSS) attacks. As a temporary workaround, consider restricting access to potentially vulnerable URL parameters until a patch is available.

Name of the Vulnerable Software and Affected Versions: NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Description: The issue arises when the NetWeaver Enterprise Portal does not sufficiently encode report data under certain conditions. This allows an attacker to craft malicious data, print it to the report, and execute a malicious script in the victim's browser when the report is opened, resulting in a Stored Cross-Site Scripting (XSS) vulnerability. Recommendations: For versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, consider disabling the report printing feature until a patch is available to prevent the execution of malicious scripts. Restrict access to the report feature to minimize the risk of exploitation. Avoid using the report feature in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS JAVA (Enterprise Portal) versions 7.10 through 7.50 Description: The issue reveals sensitive information in one of its HTTP requests. An attacker can use this in conjunction with other attacks, such as XSS, to steal this information. Recommendations: For versions 7.10 through 7.50, consider restricting access to sensitive HTTP requests until a patch is available. As a temporary workaround, consider implementing additional security measures to protect against XSS attacks. Avoid using sensitive information in HTTP requests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SAP Solution Manager (Trace Analysis) version 720 **Description** The issue allows for misuse of a parameter in the application URL, leading to an Open Redirect vulnerability. An attacker can enter a link to a malicious site as a parameter in the application URL and share it with the end user, who could potentially become a victim of the attack. This could trick the user into entering credentials or downloading malicious software. **Recommendations** For SAP Solution Manager (Trace Analysis) version 720, consider restricting access to the vulnerable parameter in the application URL to minimize the risk of exploitation. Avoid using the vulnerable parameter in the application URL until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP Solution Manager and SAP Focused Run versions 9.7, 10.1, 10.5, 10.7 **Description** The issue allows an unauthenticated attacker to bypass authentication if the default passwords for `Admin` and `Guest` have not been changed by the administrator. This may impact the confidentiality of the service. **Recommendations** For versions 9.7, 10.1, 10.5, 10.7, update to the version provided in WILY INTRO ENTERPRISE to resolve the issue. As a temporary workaround, consider changing the default passwords for `Admin` and `Guest` to prevent unauthorized access.