Patch Day: July 2024
Released July 9, 2024 · 18 notes · Source: SAP Security Patch Day page
Scheduled for July 9, 2024 (second Tuesday)
- New
- 16
- Updated
- 2
- Critical
- 0
- High
- 2
- Highest CVSS
- 7.7
- Known exploited
- 0
Our summary
18 notes (16 new, 2 updated). 0 Critical and 2 High. Highest CVSS 7.7.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in PDCE
Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce
All notes
SAP’s introduction states 16 new notes and 2 updates; SAP’s table lists 18 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3483344 | Missing Authorization check in PDCE New | SAP PDCE | High | 7.7 | CVE-2024-39592 |
| 3490515 | Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce New | SAP Commerce Cloud | High | 7.2 | CVE-2024-39597 |
| 3466801 | Information Disclosure vulnerability in SAP Landscape Management New | SAP Landscape Management | Medium | 6.9 | CVE-2024-39593 |
| 3459379 | Unrestricted file upload in SAP Document Builder (HTTP service) Update | SAP Document Builder | Medium | 6.5 | CVE-2024-34683 |
| 3467377 | Multiple vulnerabilities in SAP CRM (WebClient UI) New | SAP CRM WebClient UI | Medium | 6.1 | CVE-2024-37173, CVE-2024-37174, CVE-2024-39598, CVE-2024-37175 |
| 3468681 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor New | SAP NetWeaver Knowledge Management XMLEditor | Medium | 6.1 | CVE-2024-34685 |
| 3482217 | Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation New | SAP Business Warehouse - Business Planning and Simulation | Medium | 6.1 | CVE-2024-39594, CVE-2024-39595 |
| 3457354 | Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) New | SAP S/4HANA Finance | Medium | 5.4 | CVE-2024-37172 |
| 3458789 | Server-Side Request Forgery in SAP Business Workflow (WebFlow Services) New | SAP Business Workflow | Medium | 5.0 | CVE-2024-34689 |
| 3461110 | Information Disclosure vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 5.0 | CVE-2024-39600 |
| 3469958 | Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal) New | SAP Transportation Management | Medium | 5.0 | CVE-2024-37171 |
| 3483993 | Prerequisite for Security Note 3458789 New | SAP Business Workflow | Medium | 5.0 | CVE-2024-34689 |
| 3485805 | Allowlisting of callback-URLs in SAP Business Workflow (WebFlow Services) New | SAP Business Workflow | Medium | 5.0 | CVE-2024-34689 |
| 3456952 | Protection Mechanism Failure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2024-39599 |
| 3476348 | Missing Authorization check vulnerability in SAP Enable Now New | SAP Enable Now | Medium | 4.3 | CVE-2024-39596 |
| 3101986 | Enable CSP support for OP1909 in SAP CRM WebClient UI Update | SAP CRM WebClient UI | Medium | 4.1 | No CVE |
| 3454858 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2024-37180 |
| 3476340 | Unrestricted File upload vulnerability in SAP Enable Now New | SAP Enable Now | Low | 3.3 | CVE-2024-34692 |