SAP Security Patch Day: April 2024
Released April 9, 2024 · 10 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for April 9, 2024 (second Tuesday)
- SAP notes
- 10
- Critical
- 0
- High
- 3
- Highest CVSS
- 8.8
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
10 notes with SAP CVEs. 0 Critical and 3 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine
Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence
Directory Traversal vulnerability in SAP Asset Accounting
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 10 of 10
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3434839 | Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine New | SAP NetWeaver AS Java User Management Engine | High | 8.8 | CVE-2024-27899 |
| 3421384 | Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence New | SAP BusinessObjects Web Intelligence | High | 7.7 | CVE-2024-25646 |
| 3438234 | Directory Traversal vulnerability in SAP Asset Accounting New | SAP Asset Accounting | High | 7.2 | CVE-2024-27901 |
| 3359778 | Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2024-30218 |
| 3441944 | Missing authorization check in SAP Enable Now Manager NewPublished outside Patch Day | SAP Enable Now | Medium | 6.5 | CVE-2024-32730 |
| 3442378 | Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data) New | SAP Group Reporting Data Collection | Medium | 6.5 | CVE-2024-28167 |
| 3425188 | Server-Side Request Forgery in SAP NetWeaver New | SAP NetWeaver | Medium | 5.3 | CVE-2024-27898 |
| 3421453 | Cross-Site Scripting (XSS) vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 4.8 | CVE-2024-30214, CVE-2024-30215 |
| 3427178 | Missing Authorization check in SAP S/4 HANA (Cash Management) New | SAP S/4HANA | Medium | 4.3 | CVE-2024-30216 |
| 3430173 | Missing Authorization check in SAP S/4 HANA (Cash Management) New | SAP S/4HANA | Medium | 4.3 | CVE-2024-30217 |