Sap Abap Platform
Monthly
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
Memory disclosure in SAP ABAP Platform exposes residual data from previously allocated memory buffers to unauthenticated remote attackers via a specially crafted request to an internal component. Affected deployments include ABAP Platform 7.54, KERNEL 7.53, KRNL64UC 7.53, and 7.77, with the vendor characterizing the leaked data as limited and non-sensitive. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, consistent with the moderate CVSS 5.3 rating reflecting low confidentiality impact with no integrity or availability consequences.
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
Memory disclosure in SAP ABAP Platform exposes residual data from previously allocated memory buffers to unauthenticated remote attackers via a specially crafted request to an internal component. Affected deployments include ABAP Platform 7.54, KERNEL 7.53, KRNL64UC 7.53, and 7.77, with the vendor characterizing the leaked data as limited and non-sensitive. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, consistent with the moderate CVSS 5.3 rating reflecting low confidentiality impact with no integrity or availability consequences.