Security News > 2021 > February > SAP Commerce Critical Security Bug Allows RCE
SAP is warning of a critical vulnerability in its SAP Commerce platform for e-commerce businesses.
Drools is an engine that makes up the rules engine for SAP Commerce.
A patch has been issued; however, Fritsch said, the fixes for the vulnerability only address the default permissions when initializing a new installation of SAP Commerce.
"The good news is that for existing installations, these manual remediation steps can be used as a full workaround for SAP Commerce installations that cannot install the latest patch releases in a timely manner."
The vulnerability update was one of seven security notes released on Tuesday by SAP. The other six releases were updates to previously released Patch Tuesday security notes.
Another critical-severity flaw that was previously released and updated on Tuesday included multiple flaws in SAP Business Warehouse, a data "Warehousing" product based on the SAP NetWeaver ABAP platform, which collects and stores data.
News URL
https://threatpost.com/sap-commerce-critical-security-bug/163822/
Related news
- MFA bypass becomes a critical security issue as ransomware tactics advance (source)
- HPE patches three critical security holes in Aruba PAPI (source)
- Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519) (source)
- Critical Zimbra RCE flaw exploited to backdoor servers using emails (source)
- CISA: Network switch RCE flaw impacts critical infrastructure (source)
- Critical Ivanti RCE flaw with public exploit now used in attacks (source)
- Two simple give-me-control security bugs found in Optigo network switches used in critical manufacturing (source)
- Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast (source)
- CISA says critical Fortinet RCE flaw now exploited in attacks (source)
- CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches (source)