Patch Day: February 2024
Released February 13, 2024 · 16 notes · Source: SAP Security Patch Day page
Scheduled for February 13, 2024 (second Tuesday)
- New
- 13
- Updated
- 3
- Critical
- 2
- High
- 6
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
16 notes (13 new, 3 updated). 2 Critical and 6 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
Code Injection vulnerability in SAP ABA (Application Basis)
Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application)
XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
All notes
SAP’s introduction states 13 new notes and 3 updates; SAP’s table lists 16 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3420923 | Code Injection vulnerability in SAP ABA (Application Basis) New | SAP ABA | Critical | 9.1 | CVE-2024-22131 |
| 3417627 | Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application) New | SAP NetWeaver AS Java | High | 8.8 | CVE-2024-22126 |
| 3426111 | XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures) New | SAP NetWeaver AS Java | High | 8.6 | CVE-2024-24743 |
| 3410875 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM WebClient UI | High | 7.6 | CVE-2024-22130 |
| 3421659 | Code Injection vulnerability in SAP IDES Systems New | IDES Systems | High | 7.4 | CVE-2024-22132 |
| 3424610 | Improper Certificate Validation in SAP Cloud Connector New | SAP Cloud Connector | High | 7.4 | CVE-2024-25642 |
| 3385711 | Information disclosure vulnerability in SAP GUI for Windows and SAP GUI for Java Update | SAP GUI for Windows and SAP GUI for Java | High | 7.3 | CVE-2023-49580 |
| 2637727 | Missing authorization check in SAP Bank Account Management New | BAM | Medium | 6.3 | CVE-2024-24739 |
| 3404025 | Cross-Site Scripting (XSS) vulnerability in SAP Companion New | SAP Companion | Medium | 5.4 | CVE-2024-22129 |
| 3360827 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2024-24740 |
| 3396109 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Business Client for HTML New | SAP NWBC for HTML | Medium | 4.7 | CVE-2024-22128 |
| 2897391 | Missing Authorization check in SAP Master Data Governance Material New | SAP Master Data Governance Material | Medium | 4.3 | CVE-2024-24741 |
| 3237638 | Missing authorization check in SAP Fiori app ("My Overtime Requests") New | SAP Fiori | Medium | 4.3 | CVE-2024-25643 |
| 3158455 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM | Medium | 4.1 | CVE-2024-24742 |
| 3363690 | Directory Traversal vulnerability in SAP Master Data Governance Update | SAP Master Data Governance | Low | 3.5 | CVE-2023-49058 |