SAP Security Patch Day: June 2024
Released June 11, 2024 · 10 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for June 11, 2024 (second Tuesday)
- SAP notes
- 10
- Critical
- 0
- High
- 2
- Highest CVSS
- 8.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
10 notes with SAP CVEs. 0 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 8.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 10 of 10
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3457592 | Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation New | SAP Financial Consolidation | High | 8.1 | CVE-2024-37177, CVE-2024-37178 |
| 3460407 | Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) New | SAP NetWeaver AS Java | High | 7.5 | CVE-2024-34688 |
| 3453170 | Denial of service (DOS) in SAP NetWeaver and ABAP platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2024-33001 |
| 3459379 | Unrestricted file upload in SAP Document Builder (HTTP service) New | SAP Document Builder | Medium | 6.5 | CVE-2024-34683 |
| 3466175 | Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) New | SAP S/4HANA | Medium | 6.5 | CVE-2024-34691 |
| 3465129 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM WebClient UI | Medium | 6.1 | CVE-2024-34686 |
| 3465455 | Missing Authorization check in SAP BW/4HANA Transformation and DTP New | SAP BW/4HANA Transformation and Data Transfer Process | Medium | 5.5 | CVE-2024-37176 |
| 3457265 | Missing Authorization check in SAP Student Life Cycle Management (SLcM) New | SAP Student Life Cycle Management | Medium | 5.4 | CVE-2024-34690 |
| 3425571 | Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2024-28164 |
| 3441817 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling) New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2024-34684 |