Skip to content
ERP LEADERS
Subscribe to the brief Follow on LinkedIn

The news behind the software that runs companies, explained for everyone.

Security

SAP fixed 20 security flaws on Tuesday. Two could let attackers seize systems.

SAP released fixes for 20 security flaws on its October Security Patch Day, four of them rated critical, Security Online reported on 13 October.

ERP LEADERS news desk · · First reported by Security Online · Edition no. 36

Two are rated 9.9 out of 10. One is in S/4HANA, SAP's main business software: specially built input can run as the system's own program code, which the report describes as a "full compromise of the affected system", meaning an attacker could take it over. The other is in a tool for building SAP application screens, where a skipped permission check can lead to a full compromise of a connected system, depending on how the connection is set up.

The top-rated flaw, 10 out of 10, sits in the SAP Cloud SDK for Python, a developer toolkit for apps that serve many customers at once. Without logging in, an outsider can redirect the app's login requests and take the keys it uses to reach other systems.

SAP reports no attacks using these flaws so far, and no public attack recipe has been confirmed, the report says.

A fix protects a system only once it is applied. The score says nothing about how long a fix waits for the next scheduled maintenance.

Which of these SAP products does your company run, and which fix would go in this week?

Image: AI-generated.

Sources

Spotted an error? Tell us. Every correction is logged on Standards.

Your reading room

Companies in this story
SAP

Our file on SAP

  1. 12 Oct

    UBS said it expects SAP's cloud backlog to slow. SAP reports on 21 October.

  2. 11 Oct

    SAP was in Germany's plan for government AI. Berlin has now dropped the plan.

  3. 10 Oct

    SAP's user group asked firms about live AI. Only 3% ran SAP's.

  4. 10 Oct

    SAP now moves customers' money through its own payment firm. It named no fee.

  5. 9 Oct

    SAP showed its AI finance assistants. ITOCHU first had to resolve 3,000 modifications.

All 39 SAP stories

For your next steering committee

Questions for your own programme. They are not findings about any company in this story.

  1. 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
  2. 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
  3. 3Ask how long a restore took the last time it was tested.

Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01

Founding reader view is on in this browser. It is a reading view, not secure access. Print the working sheet

Founding reader

Welcome back. · Issue 01

Keep reading

The ERP LEADERS brief Subscribe