This post by SAP Product Security Response Team shares information on Patch Day Security Notes* that are released on second Tuesday of every month and fix vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on a priority to protect their SAP landscape.
On 14th of January 2020, SAP Security Patch Day saw the release of 6 Security Notes. There are 1 updates to previously released Patch Day Security Notes.
List of security notes released on January Patch Day:
| Note# | Title | Priority | CVSS |
| 2863743 | [CVE-2020-6305] Cross-Site Scripting (XSS) vulnerability in Rest Adapter of SAP Process Integration | Medium | 6.1 |
| 2848498 | [CVE-2020-6304] Denial of service (DOS) in SAP NetWeaver Internet Communication Manager | Medium | 5.9 |
| 2845401 | Missing Authorization check in Realtech RTCISM 100 | Medium | 5.4 |
| 2772325 | [CVE-2020-6303] Improper input validation in SAP Disclosure Management Product - SAP Disclosure Management, Version - 10.1 | Medium | 5.4 |
| 2863397 | [CVE-2020-6307] Missing Authorization Check in Automated Note Search Tool (SAP_BASIS) Product - Automated Note Search Tool (SAP Basis), Versions - 7.0, 7.01,7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54 | Medium | 4.3 |
| 2843016 | [CVE-2019-0388] Content spoofing vulnerability in UI5 HTTP Handler | Medium | 4.3 |
| 2865348 | [CVE-2020-6306] Missing Authorization check in SAP Leasing | Low | 2.7 |
________________________________________________________________________________
Security Notes vs Vulnerability Types# - January 2020
#One security note can fix multiple vulnerabilities on same product
Security Notes vs Priority Distribution (August 2019 – January 2020)**
* Patch Day Security Notes are all notes that appear under the category of “Patch Day Notes” in SAP Support Portal
** Any Patch Day Security Note released after the second Tuesday, will be accounted for in the following SAP Security Patch Day.
Customers who would like to take a look at all Security Notes published or updated after December 10, 2019, go to Launchpad Expert Search → Filter 'SAP Security Notes' released between 'December 11, 2019 - January 14, 2020' → Go.
To know more about the security researchers and research companies who have contributed for security patches of this month, visit SAP Product Security Response Acknowledgement Page.
Do write to us at secure@sap.com with all your comments and feedback on this blog post.