Patch Day: November 2024
Released November 12, 2024 · 10 notes · Source: SAP Security Patch Day page
Scheduled for November 12, 2024 (second Tuesday)
- New
- 8
- Updated
- 2
- Critical
- 0
- High
- 2
- Highest CVSS
- 8.8
- Known exploited
- 0
Our summary
10 notes (8 new, 2 updated). 0 Critical and 2 High. Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
Missing Authorization check in SAP PDCE
All notes
SAP’s introduction states 8 new notes and 2 updates; SAP’s table lists 10 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 10 of 10
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3520281 | Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher New | SAP Web Dispatcher | High | 8.8 | CVE-2024-47590 |
| 3483344 | Missing Authorization check in SAP PDCE Update | SAP PDCE | High | 7.7 | CVE-2024-39592 |
| 3335394 | Missing Authorization check in SAP NetWeaver AS Java (System Landscape Directory) New | SAP NetWeaver AS Java | Medium | 6.5 | CVE-2024-42372 |
| 3509619 | Local Privilege Escalation in SAP Host Agent New | SAP Host Agent | Medium | 6.3 | CVE-2024-47595 |
| 3393899 | Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2024-47592 |
| 3504390 | NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2024-47586 |
| 3522953 | Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager) New | SAP NetWeaver AS Java | Medium | 4.7 | CVE-2024-47588 |
| 3508947 | Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2024-47593 |
| 3392049 | Missing Authorization check in SAP Bank Account Management Update | SAP Bank Account Management | Low | 3.5 | CVE-2024-33000 |
| 3498470 | Missing authorization check in SAP Cash Management (Cash Operations) New | SAP Cash Management | Low | 3.5 | CVE-2024-47587 |