Here is an overview of the security vulnerabilities for the month of September 2021 (Base Score grater than 8.0):
SAP
CVE-2021-37535 – Missing Authorization check in SAP NetWeaver Application Server for Java (JMS Connector Service)
Base Score: 10.0
Base Score: 10.0 Affected component: SAP NetWeaver Application Server for Java (JMS Connector Service)
This vulnerability is due to the fact that the NetWeaver Application Server for Java / JMS Connector Service component does not make adequate checks during authentication. This means that it is possible to gain access even without authentication or with defective authentication.
This vulnerability is very critical and we urgently recommend you to close it through the current updates!
CVE-2021-33698 – Unrestricted File Upload vulnerability in SAP Business One
Base Score: 9.9
Affected component: SAP Business One
A lack of checking during authentication makes possible this vulnerability and consequently access as well.
We urgently recommend action at this point and the installing of the updates.
CVE-2021-38176 – SQL Injection vulnerability in SAP NZDT Mapping
Base Score: 9.9
Affected component: SAP NZDT Mapping Table Framework
This CVE makes possible access through a vulnerability in the SAP NZDT Mapping Table Framework.
At this point our recommendation is to remove this vulnerability as soon as possible through updates so that you can use this component.
CVE-2021-38163 – Unrestricted File Upload vulnerability in SAP NetWeaver (Visual Composer 7.0 RT)
Base Score: 9.9
Affected component: SAP NetWeaver (Visual Composer 7.0 RT)
This vulnerability makes possible read, amend and write rights.
We recommend closing this vulnerability by using the program in the course of the updates.
CVE-2021-37531 – Code Injection vulnerability in SAP NetWeaver
Base Score: 9.9
Affected component: SAP NetWeaver Knowledge Management
A classical Code Injection vulnerability in SAP NetWeaver Knowledge Management makes access possible for potential attackers.
Please close this vulnerability in short order with the current updates.
CVE-2021-33672 – Multiple vulnerabilities in SAP Contact Center
Base Score: 9.6
Affected component: SAP Contact Center
Due to an improper cleaning up of inputs an authenticated user with certain privileges can remotely call up the NZDT function module that was run in the solution section so as to execute a manipulated query and so obtain access to the backend database. If this is successfully exploited the threatening attacker had completely endanger the confidentiality, integrity and availability of the system The correction should be applied on the affected systems via SNOTE.
For that reason we urgently recommend closing this vulnerability by updating.
CVE-2021-38162 – HTTP Request Smuggling in SAP Web Dispatcher
Base Score: 8.9
Affected component: SAP Web Dispatcher
SAP NetWeaver Visual Composer makes it possible for an attacker who has been authenticated as a non-administrator user up upload a malicious file via a network and to run it so that operating system commands can be executed with the rights of the Java Server process. These commands can be used to read or amend data on the Server or to shut down the Server so that it is no longer available. Any affected systems must be patched.
We recommend closing this vulnerability as soon as possible by using the product.
Microsoft
CVE-2021-26435 – Windows Scripting Engine Memory Corruption Vulnerability
Base Score: 8.1
Affected component: Windows Scripting Engine
This vulnerability allows attackers to get into Windows Client version 7 – 10 and also Windows Server versions 2008 – 2022. A prepared file can be provided for this via mail or a prepared Website. The vulnerability can become active and be exploited by the attacker as soon as the user executes this file.
We recommend closing this vulnerability via Window updates in the next update cycle.
CVE-2021-38647 – Open Management Infrastructure Remote Code Execution Vulnerability
Base Score: 9.8
Affected component: Azure Open Management Infrastructure
A number of Azure products, such as, for example, Configuration Management, make an HTTP/S port available that listens to OMI (normally port 5986). This configuration in which the HTTP/S Listener is activated could make it possible for code to be executed remotely. It is important to note that most of the Azure services that use OMI do this without using the HTTP/S port.
An attacker could send a specially structured message via HTTP/S to the port that listens to OMI on a vulnerable system.
We recommend that you patch this vulnerability as a matter of urgency!
CVE-2021-36954 – Windows Bind Filter Driver Elevation of Privilege Vulnerability
Base Score: 8.8
Affected component: Windows Bind Filter Driver
This vulnerability allows attackers to gain local access relatively easily. The user rights are adequate for this and no user interaction is required to exploit the vulnerability. Windows Client versions 10 and Windows Server versions 2019 – 2022 are affected.
We recommend closing this vulnerability via Window updates as soon as possible.
CVE-2021-36965 – Windows WLAN AutoConfig Service Remote Code Execution Vulnerability
Base Score: 8.8
Affected component: Windows WLAN AutoConfig Service
This vulnerability makes it relatively easy for attackers to get in via the WLAN Network Stack. In this case no user rights are required and the user himself does not need to be active for this vulnerability to be exploited. Windows Client versions 7- 10 and Windows Server versions 2008 – 2022 are affected.
This vulnerability should be closed quickly, especially in the Client area.
CVE-2021-36967 – Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
Base Score: 8.0
Affected component: Windows WLAN AutoConfig Service
This attack is limited to the protocol level and the Network Stack. The complexity of the attack is low and no rights are required for it. However, a user would have to interact to be able to exploit the vulnerability. Windows Client versions 10 and Windows Server versions 2016 – 2019 are affected.
This vulnerability should be closed quickly, especially in the Client area, in the course of the next internal Patchdays.
CVE-2021-40444 – Microsoft MSHTML Remote Code Execution Vulnerability
Base Score: 8.8
Affected component: MSHTML
Currently this vulnerability is being actively exploited!
An attacker could structure a malicious ActiveX control element in such a way that it is used by a Microsoft Word document that includes the Browser Rendering Engine. The attacker must then bring the user to open the malicious document. Users whose accounts are configured such that they have few user rights on the system could be less affected than users who work with administrator user rights.
Microsoft Defender Antivirus and Microsoft Defender for Endpoint both offer detection of and protection for the known security vulnerability. Customers should ensure that their anti-malware products are fully updated. Customers who make use of automatic updates do not need to take any additional action. Corporate customers who administer updates should select detection build 1.349.22.0 or later and use it in their environments. Microsoft Defender for Endpoint warnings are displayed as follows: “Suspicious Cpl file execution”.
Windows Client versions 7- 10 and Windows Server versions 2008 – 2022 are affected.
This vulnerability should be closed as a matter of urgency through the current Windows updates!
If you have any questions or are not sure how to handle the vulnerabilities named above, don’t hesitate to contact us.
We will help you to be more secure!
