Patch Day: April 2024
Released April 9, 2024 · 12 notes · Source: SAP Security Patch Day page
Scheduled for April 9, 2024 (second Tuesday)
- New
- 10
- Updated
- 2
- Critical
- 0
- High
- 3
- Highest CVSS
- 8.8
- Known exploited
- 0
Our summary
12 notes (10 new, 2 updated). 0 Critical and 3 High. Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine
Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence
Directory Traversal vulnerability in SAP Asset Accounting
All notes
SAP’s introduction states 10 new notes and 2 updates; SAP’s table lists 12 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 12 of 12
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3434839 | Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine New | SAP NetWeaver AS Java User Management Engine | High | 8.8 | CVE-2024-27899 |
| 3421384 | Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence New | SAP BusinessObjects Web Intelligence | High | 7.7 | CVE-2024-25646 |
| 3438234 | Directory Traversal vulnerability in SAP Asset Accounting New | SAP Asset Accounting | High | 7.2 | CVE-2024-27901 |
| 3442741 | Stack overflow vulnerability on the component images of SAP Integration Suite (EDGE INTEGRATION CELL) New | SAP Edge Integration Cell, Versions older than 8.13.5 | Medium | 6.8 | No CVE |
| 3164677 | Information Disclosure vulnerability in SAP Employee Self Service(Fiori My Leave Request) Update | SAP Employee Self Service | Medium | 6.5 | CVE-2022-29613 |
| 3359778 | Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2024-30218 |
| 3442378 | Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data) New | SAP Group Reporting Data Collection | Medium | 6.5 | CVE-2024-28167 |
| 3156972 | URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) Update | SAP S/4HANA | Medium | 6.1 | CVE-2023-40306 |
| 3425188 | Server-Side Request Forgery in SAP NetWeaver (tc~esi~esp~grmg~wshealthcheck~ear) New | SAP NetWeaver | Medium | 5.3 | CVE-2024-27898 |
| 3421453 | Cross-Site Scripting (XSS) vulnerabilities in SAP Business Connector New | SAP Business Connector | Medium | 4.8 | CVE-2024-30214, CVE-2024-30215 |
| 3427178 | Missing Authorization check in SAP S/4 HANA (Cash Management) New | SAP S/4HANA | Medium | 4.3 | CVE-2024-30216 |
| 3430173 | Missing Authorization check in SAP S/4 HANA (Cash Management) New | SAP S/4HANA | Medium | 4.3 | CVE-2024-30217 |