SAP Security Patch Day: March 2024
Released March 12, 2024 · 7 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for March 12, 2024 (second Tuesday)
- SAP notes
- 7
- Critical
- 1
- High
- 0
- Highest CVSS
- 9.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
7 notes with SAP CVEs. 1 Critical and 0 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 7 of 7
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3433192 | Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) New | SAP NetWeaver AS Java | Critical | 9.1 | CVE-2024-22127 |
| 3377979 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI) New | SAP NetWeaver AS ABAP applications based on SAPGUI for HTML | Medium | 5.4 | CVE-2024-27902 |
| 3425682 | Information Disclosure vulnerability in NetWeaver (WSRM) New | NetWeaver | Medium | 5.3 | CVE-2024-25644 |
| 3428847 | Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal) New | SAP NetWeaver | Medium | 5.3 | CVE-2024-25645 |
| 3434192 | Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages) New | SAP NetWeaver Process Integration | Medium | 5.3 | CVE-2024-28163 |
| 3417399 | Improper Access Control in SAP Fiori Front End Server New | SAP Fiori Front End Server | Medium | 4.6 | CVE-2024-22133 |
| 3419022 | Missing Authorization check in SAP ABAP Platform New | SAP ABAP Platform | Medium | 4.3 | CVE-2024-27900 |