SAP patches critical flaws that permit enterprise system takeovers

SAP released security patches for critical flaws in NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence, heise reported. The fixes form part of a release containing 16 new security advisories and 4 GitHub advisories. Faulty access controls in Visual Composer can let attackers with low user privileges take over systems. Logged-in attackers can use specially crafted requests to execute malicious code in S/4HANA, while the Manufacturing Integration and Intelligence flaw can allow administrator-level compromise. SAP had given no indication that attackers were already exploiting the vulnerabilities.