SAP Security Patch Day: July 2024
Released July 9, 2024 · 14 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for July 9, 2024 (second Tuesday)
- SAP notes
- 14
- Critical
- 0
- High
- 2
- Highest CVSS
- 7.7
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
14 notes with SAP CVEs. 0 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 7.7.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP PDCE
Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 14 of 14
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3483344 | Missing Authorization check in SAP PDCE New | SAP PDCE | High | 7.7 | CVE-2024-39592 |
| 3490515 | Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce New | SAP Commerce Cloud | High | 7.2 | CVE-2024-39597 |
| 3466801 | Information Disclosure vulnerability in SAP Landscape Management New | SAP Landscape Management | Medium | 6.9 | CVE-2024-39593 |
| 3467377 | Multiple vulnerabilities in SAP CRM (WebClient UI) New | SAP CRM WebClient UI | Medium | 6.1 | CVE-2024-37173, CVE-2024-37174, CVE-2024-37175, CVE-2024-39598 |
| 3468681 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor New | SAP NetWeaver Knowledge Management XMLEditor | Medium | 6.1 | CVE-2024-34685 |
| 3482217 | Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation New | SAP Business Warehouse - Business Planning and Simulation | Medium | 6.1 | CVE-2024-39594, CVE-2024-39595 |
| 3457354 | Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) New | SAP S/4HANA Finance | Medium | 5.4 | CVE-2024-37172 |
| 3458789 | Server-Side Request Forgery in SAP Business Workflow (WebFlow Services) New | SAP Business Workflow | Medium | 5.0 | CVE-2024-34689 |
| 3461110 | Information Disclosure vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 5.0 | CVE-2024-39600 |
| 3469958 | Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal) New | SAP Transportation Management | Medium | 5.0 | CVE-2024-37171 |
| 3456952 | Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2024-39599 |
| 3476348 | Missing Authorization check vulnerability in SAP Enable Now New | SAP Enable Now | Medium | 4.3 | CVE-2024-39596 |
| 3454858 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2024-37180 |
| 3476340 | Unrestricted File upload vulnerability in SAP Enable Now New | SAP Enable Now | Low | 3.3 | CVE-2024-34692 |