Patch Day: May 2024
Released May 14, 2024 · 17 notes · Source: SAP Security Patch Day page
Scheduled for May 14, 2024 (second Tuesday)
- New
- 14
- Updated
- 3
- Critical
- 3
- High
- 1
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
17 notes (14 new, 3 updated). 3 Critical and 1 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
Multiple vulnerabilities in SAP CX Commerce
File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform
All notes
SAP’s introduction states 14 new notes and 3 updates; SAP’s table lists 17 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 17 of 17
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3455438 | Multiple vulnerabilities in SAP CX Commerce New | SAP Commerce Cloud | Critical | 9.8 | CVE-2019-17495, CVE-2022-36364 |
| 3448171 | File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2024-33006 |
| 3431794 | Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | High | 8.1 | CVE-2024-28165 |
| 3441944 | Missing authorization check in SAP Enable Now Manager New | SAP Enable Now | Medium | 6.5 | CVE-2024-32730 |
| 3448445 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2024-34687 |
| 3450286 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2024-32733 |
| 3460772 | Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS) New | SAP S/4HANA | Medium | 6.1 | CVE-2024-33002 |
| 3447467 | Missing Authorization check in SAP My Travel Requests New | My Travel Requests | Medium | 5.5 | CVE-2024-32731 |
| 2745860 | Information Disclosure in Enterprise Services Repository of SAP Process Integration Update | SAP Process Integration | Medium | 5.3 | No CVE |
| 3349468 | Memory Corruption vulnerability in SAP Replication Server New | SAP Replication Server | Medium | 4.9 | CVE-2024-33008 |
| 2174651 | Potential information disclosure relating to PI Integration Directory Update | SAP Process Integration | Medium | 4.3 | No CVE |
| 3434666 | Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) New | SAP S/4HANA | Medium | 4.3 | CVE-2024-4139, CVE-2024-4138 |
| 3449093 | Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices) New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2024-33004 |
| 1938764 | SQL injection vulnerability in SAP Global Label Management (GLM) New | SAP Global Label Management | Medium | 4.2 | CVE-2024-33009 |
| 3392049 | Missing Authorization check in SAP Bank Account Management New | SAP Bank Account Management | Low | 3.5 | CVE-2024-33000 |
| 3446076 | Client-side script execution vulnerability in SAP UI5(PDFViewer) New | SAPUI5 | Low | 3.5 | CVE-2024-33007 |