The US Computer Emergency Readiness Team (US-CERT) has issued a security alert, revealing that hackers are exploiting outdated or misconfigured SAP business applications. At least 36 organisations globally, across a range of industries, are currently affected. Security firm, Onapsis, discovered the vulnerability, which sits on the application layer. US-CERT said: “The observed indicators relate to the abuse of the Invoker Servlet, a built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms)”. Although a patch was issued for 2010 this in, some companies continue to run older or misconfigured systems, which make them vulnerable. As a result, hackers have the potential to gain full access to affected SAP systems and could control the associated business information and processes.
The US Computer Emergency Readiness Team (US-CERT) has issued a security alert, revealing that hackers are exploiting outdated or misconfigured SAP business applications. At least 36 organisations globally, across a range of industries, are currently affected. Security firm, Onapsis, discovered the vulnerability, which sits on the application layer. US-CERT said: “The observed indicators relate to the abuse of the Invoker Servlet, a built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms)”. Although a patch was issued for this in 2010, some companies continue to run older or misconfigured systems, which make them vulnerable. As a result, hackers have the potential to gain full access to affected SAP systems and could control the associated business information and processes.