SAP Security Patch Day: November 2024
Released November 12, 2024 · 8 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for November 12, 2024 (second Tuesday)
- SAP notes
- 8
- Critical
- 0
- High
- 1
- Highest CVSS
- 8.8
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
8 notes with SAP CVEs. 0 Critical and 1 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 8 of 8
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3520281 | Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher New | SAP Web Dispatcher | High | 8.8 | CVE-2024-47590 |
| 3335394 | Missing Authorization check in SAP NetWeaver AS Java (System Landscape Directory) New | SAP NetWeaver AS Java | Medium | 6.5 | CVE-2024-42372 |
| 3509619 | Local Privilege Escalation in SAP Host Agent New | SAP Host Agent | Medium | 6.3 | CVE-2024-47595 |
| 3393899 | Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2024-47592 |
| 3504390 | NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2024-47586 |
| 3522953 | Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager) New | SAP NetWeaver AS Java | Medium | 4.7 | CVE-2024-47588 |
| 3508947 | Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2024-47593 |
| 3498470 | Missing authorization check in SAP Cash Management (Cash Operations) New | SAP Cash Management | Low | 3.5 | CVE-2024-47587 |