SAP Security Patch Day: December 2024
Released December 10, 2024 · 9 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for December 10, 2024 (second Tuesday)
- SAP notes
- 9
- Critical
- 1
- High
- 2
- Highest CVSS
- 9.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
9 notes with SAP CVEs. 1 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 9 of 9
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3536965 | Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services) New | SAP NetWeaver AS Java | Critical | 9.1 | CVE-2024-47578, CVE-2024-47579, CVE-2024-47580 |
| 3469791 | Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.5 | CVE-2024-54198 |
| 3542543 | Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview) New | SAP NetWeaver Administrator | High | 7.2 | CVE-2024-54197 |
| 3351041 | XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2024-47582 |
| 3524933 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | Medium | 5.3 | CVE-2024-32732 |
| 3522332 | Missing Authorization check in SAP HCM (Approve Timesheets version 4) New | SAP HCM | Medium | 4.3 | CVE-2024-47581 |
| 3536361 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2024-47585 |
| 3504847 | DLL Hijacking vulnerability in SAP Product Lifecycle Costing New | SAP Product Lifecycle Costing | Low | 3.3 | CVE-2024-47576 |
| 3535451 | Information Disclosure vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Low | 2.7 | CVE-2024-47577 |