SAP Release Fixes For Multiple Security Flaws

Share post:

SAP has released security patches to address three vulnerabilities discovered by Onapsis security researchers. SAP released the fixes to form a group of 19 security notes released by the company about a number of security issues.

The patched vulnerabilities are categorized as ICMAD and allow attackers to execute serious malicious activities on SAP users, business information and processes.

This activity then affects unpatched SAP applications. The focus is SAP’s Internet Communication Manager (ICM). ICM enables HTTP(S) communications in SAP systems.

According to the Onapsis researchers, threat actors exploit the flaw by sending malicious payloads using various HTTP smuggling techniques.

They can successfully exploit SAP Java or ABAP systems if an HTTP request cannot be distinguished from a valid message. Vulnerabilities in affected systems can be exploited over the internet and pre-authentication, i.e. they cannot be restricted by using multi-factor authentication controls.

“Abusing these vulnerabilities could be simple for an attacker as it requires no previous authentication, no necessary preconditions, and the payload can be sent through HTTP(S),” explained JP Perez-Etchegoyen, Onapsis CTO.

For more information, read the original story in ZDNet.


Related articles

Cyber Security Today, May 20, 2024 -Ransomware gang claims it hit a Canadian internet provider

A ransomware gang claims it hit a Canadian internet provider. Welcome to Cyber Security Today. It's Monday May 20th,...

Cyber Security Today, Week in Review for week ending Friday May 17, 2024

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, May 17th,...

Cyber Security Today, May 17, 2024 – Malware hiding in Apache Tomcat servers

Malware hiding in Apache Tomcat servers, new backdoors found, and more Welcome to Cyber Security Today. It's Friday, May...

MIT students exploit blockchain vulnerability to steal 25 million dollars

Two MIT students have been implicated in a highly sophisticated cryptocurrency heist, where they reportedly exploited a vulnerability...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways