SAP製品に重大なセキュリティ脆弱性、アップデートを

米国土安全保障省サイバーセキュリティ・インフラストラクチャセキュリティ庁(CISA: Cybersecurity and Infrastructure Security Agency)は7月12日(米国時間)、「SAP Releases July 2022 Security Updates｜CISA」において、SAPの複数製品に複数の脆弱性が存在すると伝えた。これら脆弱性を悪用されると、攻撃者によって影響を受けたシステムの制御権が乗っ取られる危険性がある。

脆弱性に関する情報は次のページにまとまっている。

SAP Security Patch Day –July2022

SAP Security Patch Day –July2022

脆弱性が存在するとされるプロダクトは次のとおり。

SAP Adaptive Server Enterprise (ASE), Versions KERNEL 7.22, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53
SAP Business Objects, Version 420
SAP Business One License serviceAPI, Version 10.0
SAP Business One, Version 10.0
SAP BusinessObjects Business Intelligence Platform (Central management console), Versions 420, 430
SAP BusinessObjects Business Intelligence Platform (LCM), Versions 420, 430
SAP BusinessObjects Business Intelligence Platform (Visual Difference Application), Versions 420, 430
SAP BusinessObjects Business Intelligence Platform 4.x, Versions 420, 430
SAP BusinessObjects BW Publisher Service, Versions 420,430
SAP Enterprise Extension Defense Forces & Public Security (EA-DFPS), Versions 605, 606, 616,617,618, 802, 803, 804, 805, 806
SAP Enterprise Portal, Versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
SAP NetWeaver Application Server for ABAP and ABAP Platform, Versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, 788
SAP NetWeaver Enterprise Portal (WPC), Versions 7.30, 7.31, 7.40, 7.50
SAP NetWeaver Enterprise Portal, Versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
SAP3D Visual Enterprise Viewer, Version 9.0
SAPS/4HANA(Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer), Versions 104, 105, 106
SAPS/4HANA, Versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127