SAP Security Patch Day: February 2024
Released February 13, 2024 · 13 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for February 13, 2024 (second Tuesday)
- SAP notes
- 13
- Critical
- 1
- High
- 4
- Highest CVSS
- 9.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
13 notes with SAP CVEs. 1 Critical and 4 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP ABA (Application Basis)
XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
Code Injection vulnerability in SAP IDES Systems
Improper Certificate Validation in SAP Cloud Connector
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 13 of 13
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3420923 | Code Injection vulnerability in SAP ABA (Application Basis) New | SAP ABA | Critical | 9.1 | CVE-2024-22131 |
| 3426111 | XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures) New | SAP NetWeaver AS Java | High | 8.6 | CVE-2024-24743 |
| 3410875 | Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI New | SAP CRM WebClient UI | High | 7.6 | CVE-2024-22130 |
| 3421659 | Code Injection vulnerability in SAP IDES Systems New | SAP IDES Systems | High | 7.4 | CVE-2024-22132 |
| 3424610 | Improper Certificate Validation in SAP Cloud Connector New | SAP Cloud Connector | High | 7.4 | CVE-2024-25642 |
| 2637727 | Missing authorization check in SAP BAM (Bank Account Management) New | SAP BAM | Medium | 6.3 | CVE-2024-24739 |
| 3417627 | Cross Site Scripting vulnerability in SAP NetWeaver AS Java (User Admin Application) New | SAP NetWeaver AS Java | Medium | 6.1 | CVE-2024-22126 |
| 3404025 | Cross-Site Scripting (XSS) vulnerability in SAP Companion New | SAP Companion | Medium | 5.4 | CVE-2024-22129 |
| 3360827 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2024-24740 |
| 3396109 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Business Client for HTML New | SAP NetWeaver Business Client for HTML | Medium | 4.7 | CVE-2024-22128 |
| 2897391 | Missing Authorization check in SAP Master Data Governance Material New | SAP Master Data Governance Material | Medium | 4.3 | CVE-2024-24741 |
| 3237638 | Missing authorization check in SAP Fiori app (My Overtime Requests) New | SAP Fiori | Medium | 4.3 | CVE-2024-25643 |
| 3158455 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM | Medium | 4.1 | CVE-2024-24742 |