SAP Security Patch Day: January 2024
Released January 9, 2024 · 7 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for January 9, 2024 (second Tuesday)
- SAP notes
- 7
- Critical
- 0
- High
- 3
- Highest CVSS
- 8.4
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
7 notes with SAP CVEs. 0 Critical and 3 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 8.4.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP Application Interface Framework (File Adapter)
Information Disclosure vulnerability in Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge)
Improper Authorization check in SAP LT Replication Server
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 7 of 7
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3411869 | Code Injection vulnerability in SAP Application Interface Framework (File Adapter) New | SAP Application Interface Framework | High | 8.4 | CVE-2024-21737 |
| 3386378 | Information Disclosure vulnerability in Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) New | Microsoft Edge browser extension | High | 7.4 | CVE-2024-22125 |
| 3407617 | Improper Authorization check in SAP LT Replication Server New | SAP LT Replication Server | High | 7.3 | CVE-2024-21735 |
| 3260667 | Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) New | SAP S/4HANA Finance | Medium | 6.4 | CVE-2024-21736 |
| 3387737 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2024-21738 |
| 3392626 | Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager New | SAP NetWeaver | Medium | 4.1 | CVE-2024-22124 |
| 3190894 | URL Redirection vulnerability in SAP Marketing (Contacts App) New | SAP Marketing | Low | 3.7 | CVE-2024-21734 |