Targeted News Service targetednews.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from targetednews.com Daily Mail and Mail on Sunday newspapers.
BankInfoSecurity
May 5, 2021
Compliance Twitter Get Permission
Attackers are targeting unpatched SAP applications, and the exploits could lead to the hijacking of the vulnerable systems, data theft and ransomware attacks, SAP and Onapsis Research Labs report. They note that patches for most of the flaws have been available for several years.
Onapsis, which monitored SAP applications for attack activities using its honeypots, notes it detected thousands of exploitation attempts using automated tools as well as manual techniques. Of these, about 300 were successful, but they did not result in customer breaches or compromise of SAP applications. Given the level of observed threat actors capabilities and widespread nature of the ongoing threat activity, SAP and Onapsis are proactively alerting organizations to take immediate action, including swift application of the relevant SAP security patches and performing a compromise assessment and forensic investigation of at-risk env
BankInfoSecurity
Compliance
March 29, 2021
March 31, 2021
Compliance
@prajeetspeaks) • February 12, 2021 Get Permission
SAP has issued a patch and remediation advice for a critical remote code execution vulnerability in its SAP Commerce product that could, if exploited, disrupt the entire system.
SAP Commerce organizes data, such as product information, to be propagated across communication channels. Due to a misconfiguration of the default user permissions that are shipped with SAP Commerce, several lower-privileged users and user groups gain permissions to change DroolsRule ruleContents and thus gain unintended access to these scripting facilities, says Thomas Fritsch of Onapsis Research Labs.
This vulnerability could enable unauthorized users to inject malicious code into these scripts, resulting in a strong negative impact on the application’s confidentiality, integrity and availab