Patch Day: August 2024
Released August 13, 2024 · 25 notes · Source: SAP Security Patch Day page
Scheduled for August 13, 2024 (second Tuesday)
- New
- 17
- Updated
- 8
- Critical
- 2
- High
- 4
- Highest CVSS
- 9.8
- Known exploited
- 0
Our summary
25 notes (17 new, 8 updated). 2 Critical and 4 High. Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
Server-Side Request Forgery vulnerability in applications built with SAP Build Apps
XML injection in SAP BEx Web Java Runtime Export Web Service
Prototype Pollution in SAP S/4 HANA (Manage Supply Protection)
Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)
All notes
SAP’s introduction states 17 new notes and 8 updates; SAP’s table lists 25 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 25 of 25
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3479478 | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Critical | 9.8 | CVE-2024-41730 |
| 3477196 | Server-Side Request Forgery vulnerability in applications built with SAP Build Apps New | SAP Build Apps | Critical | 9.1 | CVE-2024-29415 |
| 3485284 | XML injection in SAP BEx Web Java Runtime Export Web Service New | SAP BEx Web Java Runtime Export Web Service | High | 8.2 | CVE-2024-42374 |
| 3423268 | Prototype Pollution in SAP S/4 HANA (Manage Supply Protection) New | SAP S/4 HANA, Library | High | 7.8 | CVE-2023-30533 |
| 3460407 | Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) Update | SAP NetWeaver AS Java | High | 7.5 | CVE-2024-34688 |
| 3459935 | Information Disclosure Vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | High | 7.4 | CVE-2024-33003 |
| 3466801 | Information Disclosure vulnerability in SAP Landscape Management Update | SAP Landscape Management | Medium | 6.9 | CVE-2024-39593 |
| 3459379 | Unrestricted file upload in SAP Document Builder (HTTP service) Update | SAP Document Builder | Medium | 6.5 | CVE-2024-34683 |
| 3474590 | Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework New | SAP Shared Service Framework | Medium | 6.5 | CVE-2024-42376, CVE-2024-42377 |
| 3495876 | Multiple vulnerabilities in SAP Replication Server (FOSS) New | SAP Replication Server | Medium | 6.5 | CVE-2023-0215, CVE-2022-0778, CVE-2023-0286 |
| 3438085 | Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java), SAP Web Dispatcher and SAP Content Server New | SAP NetWeaver Application Server (ABAP and Java), SAP Web Dispatcher and SAP Content Server | Medium | 6.3 | CVE-2024-33005 |
| 3482217 | Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation Update | SAP Business Warehouse - Business Planning and Simulation | Medium | 6.1 | CVE-2024-39594 |
| 3465455 | Missing Authorization check in SAP BW/4HANA Transformation and DTP Update | SAP BW/4HANA Transformation and Data Transfer Process | Medium | 5.5 | CVE-2024-37176 |
| 3483256 | Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice New | SAP Commerce Backoffice | Medium | 5.4 | CVE-2024-41735 |
| 3471450 | Information Disclosure Vulnerability in SAP Commerce New | SAP Commerce Cloud | Medium | 5.3 | CVE-2024-41733 |
| 3458789 | Server-Side Request Forgery in SAP Business Workflow (WebFlow Services) Update | SAP Business Workflow | Medium | 5.0 | CVE-2024-34689 |
| 3487537 | Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management) New | SAP CRM ABAP | Medium | 5.0 | CVE-2024-41737 |
| 3468102 | Improper Access Control in SAP Netweaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2024-41732 |
| 3150704 | Information Disclosure in SAP Bank Account Management (Manage Banks) Update | SAP Bank Account Management | Medium | 4.5 | CVE-2023-0023 |
| 3433545 | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2024-42375, CVE-2024-28166, CVE-2024-41731 |
| 3475427 | Information Disclosure vulnerability in SAP Permit to Work New | SAP Permit to Work | Medium | 4.3 | CVE-2024-41736 |
| 3477423 | Missing Authorization check in SAP Document Builder New | SAP Document Builder | Medium | 4.3 | CVE-2024-39591 |
| 3479293 | Missing Authorization Check in SAP Student Life Cycle Management (SLcM) New | SAP Student Life Cycle Management | Medium | 4.3 | CVE-2024-42373 |
| 3494349 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2024-41734 |
| 3454858 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2024-37180 |