嗯，用户让我帮忙总结一篇文章的内容，控制在100字以内，而且不需要特定的开头。我得先仔细看看文章内容。 文章主要讲SAP修复了13个漏洞，其中包括NetWeaver的一个最高级漏洞，CVSS评分10.0。这个漏洞是反序列化问题，可能导致任意命令执行。另外还有Print Service的目录遍历漏洞和Supplier Relationship Management的文件上传漏洞。SAP没有报告这些漏洞被利用的情况。 用户的需求是简明扼要地总结，所以我要抓住关键点：修复了13个漏洞，重点描述三个关键漏洞及其影响。同时要控制字数在100字以内。 我需要确保语言简洁，信息准确。可能的结构是先总述修复了多少漏洞，然后分别点出每个关键漏洞及其影响。最后提到没有已知攻击。 现在组织一下语言： SAP修复了13个漏洞，包括NetWeaver的最高级反序列化漏洞（CVSS 10.0），可能导致任意命令执行；Print Service的目录遍历漏洞（CVSS 9.8），可覆盖系统文件；以及Supplier Relationship Management的文件上传漏洞（CVSS 9.0），允许上传恶意文件。目前未发现这些漏洞被利用的情况。 检查一下字数是否在限制内，并确保每个关键点都涵盖到了。 </think> SAP修复了13个安全漏洞，包括NetWeaver中的最高级反序列化漏洞（CVSS评分10.0），可能导致任意命令执行；Print Service中的目录遍历漏洞（CVSS评分9.8），可覆盖系统文件；以及Supplier Relationship Management中的文件上传漏洞（CVSS评分9.0），允许上传恶意文件。目前未发现这些漏洞被利用的情况。 2025-10-15 10:3:10 Author: securityaffairs.com(查看原文) 阅读量:12 收藏
SAP fixed maximum-severity bug in NetWeaver
SAP addressed 13 new flaws, including a maximum severity vulnerability in SAP NetWeaver, which could lead to arbitrary command execution.
SAP addressed 13 new vulnerabilities, including a maximum severity issue, tracked as CVE-2025-42944 (CVSS score of 10.0) in SAP NetWeaver.
The vulnerability is an insecure deserialization that could lead to arbitrary command execution.
“Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port.” reads the advisory. “The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application’s confidentiality, integrity, and availability.”
The company also addressed a Directory Traversal vulnerability in SAP Print Service tracked as CVE-2025-42937 (CVSS score of 9.8). The flaw in SAP Print Service (SAPSprint) allows unauthenticated attackers to use path traversal to overwrite system files, threatening the application’s confidentiality, integrity, and availability.
The third critical vulnerability addressed by SAP is an Unrestricted File Upload Vulnerability, tracked as CVE-2025-42910 (CVSS score of 9.0), in SAP Supplier Relationship Management.
“Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware.” reads the advisory. “On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.”
The company is not aware of attacks in the wild exploiting any of these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NetWeaver)
如有侵权请联系:admin#unsafe.sh