SAP Security Patch Day: September 2024
Released September 10, 2024 · 15 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for September 10, 2024 (second Tuesday)
- SAP notes
- 15
- Critical
- 0
- High
- 0
- Highest CVSS
- 6.5
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
15 notes with SAP CVEs. 0 Critical and 0 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 6.5.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
No Critical, High, or known-exploited notes this month.
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 15 of 15
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3488341 | Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface) New | SAP Production and Revenue Accounting | Medium | 6.5 | CVE-2024-45286 |
| 3497347 | Cross-Site Scripting (XSS) in eProcurement on S/4HANA New | SAP S/4HANA eProcurement | Medium | 6.1 | CVE-2024-42378 |
| 3501359 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2024-45279 |
| 3477359 | Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service) New | SAP NetWeaver AS Java | Medium | 6.0 | CVE-2024-45283 |
| 3425287 | DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.8 | CVE-2024-45281 |
| 3488039 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.4 | CVE-2024-42371, CVE-2024-42380, CVE-2024-44115, CVE-2024-44116, CVE-2024-44117, CVE-2024-45285 |
| 3505503 | Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application) New | SAP NetWeaver AS Java | Medium | 4.8 | CVE-2024-45280 |
| 3498221 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 4.7 | CVE-2024-44120 |
| 3437585 | Information Disclosure in SAP S/4 HANA (Statutory Reports) New | SAP S/4HANA | Medium | 4.3 | CVE-2024-44121 |
| 3481588 | Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer) New | SAP NetWeaver BW | Medium | 4.3 | CVE-2024-41729 |
| 3481992 | Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer) New | SAP Business Warehouse | Medium | 4.3 | CVE-2024-44113 |
| 3505293 | Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution) New | SAP for Oil & Gas | Medium | 4.3 | CVE-2024-44112 |
| 3496410 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 2.7 | CVE-2024-41728 |
| 2256627 | Missing authorization check in SAP Student Life Cycle Management (SLcM) New | SAP Student Life Cycle Management | Low | 2.4 | CVE-2024-45284 |
| 3507252 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 2.0 | CVE-2024-44114 |