Patch Day: September 2024
Released September 10, 2024 · 19 notes · Source: SAP Security Patch Day page
Scheduled for September 10, 2024 (second Tuesday)
- New
- 16
- Updated
- 3
- Critical
- 1
- High
- 1
- Highest CVSS
- 9.8
- Known exploited
- 0
Our summary
19 notes (16 new, 3 updated). 1 Critical and 1 High. Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
Information Disclosure Vulnerability in SAP Commerce Cloud
All notes
SAP’s introduction states 16 new notes and 3 updates; SAP’s table lists 19 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 19 of 19
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3479478 | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform Update | SAP BusinessObjects BI Platform | Critical | 9.8 | CVE-2024-41730 |
| 3459935 | Information Disclosure Vulnerability in SAP Commerce Cloud Update | SAP Commerce Cloud | High | 7.4 | CVE-2024-33003 |
| 3488341 | Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface) New | SAP Production and Revenue Accounting | Medium | 6.5 | CVE-2024-45286 |
| 3495876 | Multiple vulnerabilities in SAP Replication Server (FOSS) Update | SAP Replication Server | Medium | 6.5 | CVE-2023-0215, CVE-2022-0778, CVE-2023-0286 |
| 3497347 | Cross-Site Scripting (XSS) in eProcurement on S/4HANA New | SAP S/4HANA eProcurement | Medium | 6.1 | CVE-2024-42378 |
| 3501359 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP(CRM Blueprint Application Builder Panel) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2024-45279 |
| 3477359 | Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service) New | SAP NetWeaver AS Java | Medium | 6.0 | CVE-2024-45283 |
| 3430336 | Information Disclosure vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.9 | CVE-2013-3587 |
| 3425287 | DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.8 | CVE-2024-45281 |
| 3488039 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.4 | CVE-2024-42371, CVE-2024-44117, CVE-2024-45285, CVE-2024-42380, CVE-2024-44115, CVE-2024-44116 |
| 3505503 | Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application) New | SAP NetWeaver AS Java | Medium | 4.8 | CVE-2024-45280 |
| 3498221 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 4.7 | CVE-2024-44120 |
| 3437585 | Information Disclosure in SAP S/4 HANA (Statutory Reports) New | SAP S/4HANA | Medium | 4.3 | CVE-2024-44121 |
| 3481588 | Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer) New | SAP NetWeaver BW | Medium | 4.3 | CVE-2024-41729 |
| 3481992 | Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer) New | SAP Business Warehouse | Medium | 4.3 | CVE-2024-44113 |
| 3505293 | Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution) New | SAP for Oil & Gas | Medium | 4.3 | CVE-2024-44112 |
| 2256627 | Missing authorization check in SAP Student Life Cycle Management (SLcM) New | SAP Student Life Cycle Management | Low | 2.7 | CVE-2024-45284 |
| 3496410 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 2.7 | CVE-2024-41728 |
| 3507252 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 2.0 | CVE-2024-44114 |