SAP Security Patch Day: August 2024
Released August 13, 2024 · 14 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for August 13, 2024 (second Tuesday)
- SAP notes
- 14
- Critical
- 1
- High
- 2
- Highest CVSS
- 9.8
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
14 notes with SAP CVEs. 1 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
XML injection in SAP BEx Web Java Runtime Export Web Service
Information Disclosure Vulnerability in SAP Commerce Cloud
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 14 of 14
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3479478 | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Critical | 9.8 | CVE-2024-41730 |
| 3485284 | XML injection in SAP BEx Web Java Runtime Export Web Service New | SAP BEx Web Java Runtime Export Web Service | High | 8.2 | CVE-2024-42374 |
| 3459935 | Information Disclosure Vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | High | 7.4 | CVE-2024-33003 |
| 3474590 | Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework New | SAP Shared Service Framework | Medium | 6.5 | CVE-2024-42376, CVE-2024-42377 |
| 3438085 | Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server New | SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server | Medium | 6.3 | CVE-2024-33005 |
| 3483256 | Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice New | SAP Commerce Backoffice | Medium | 5.4 | CVE-2024-41735 |
| 3471450 | Information Disclosure Vulnerability in SAP Commerce New | SAP Commerce Cloud | Medium | 5.3 | CVE-2024-41733 |
| 3487537 | Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management) New | SAP CRM ABAP | Medium | 5.0 | CVE-2024-41737 |
| 3468102 | Improper Access Control in SAP Netweaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2024-41732 |
| 3433545 | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2024-28166, CVE-2024-41731, CVE-2024-42375 |
| 3475427 | Information Disclosure vulnerability in SAP Permit to Work New | SAP Permit to Work | Medium | 4.3 | CVE-2024-41736 |
| 3477423 | Missing Authorization check in SAP Document Builder New | SAP Document Builder | Medium | 4.3 | CVE-2024-39591 |
| 3479293 | Missing Authorization Check in SAP Student Life Cycle Management (SLcM) New | SAP Student Life Cycle Management | Medium | 4.3 | CVE-2024-42373 |
| 3494349 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2024-41734 |