Patch Day: December 2024
Released December 10, 2024 · 13 notes · Source: SAP Security Patch Day page
Scheduled for December 10, 2024 (second Tuesday)
- New
- 10
- Updated
- 3
- Critical
- 1
- High
- 4
- Highest CVSS
- 9.1
- Known exploited
- 0
Our summary
13 notes (10 new, 3 updated). 1 Critical and 4 High. Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Multiple vulnerabilities in SAP NetWeaver AS for JAVA (Adobe Document Services)
Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)
All notes
SAP’s introduction states 10 new notes and 3 updates; SAP’s table lists 13 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 13 of 13
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3536965 | Multiple vulnerabilities in SAP NetWeaver AS for JAVA (Adobe Document Services) New | SAP NetWeaver AS Java | Critical | 9.1 | CVE-2024-47578, CVE-2024-47579, CVE-2024-47580 |
| 3520281 | Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher Update | SAP Web Dispatcher | High | 8.8 | CVE-2024-47590 |
| 3469791 | Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.5 | CVE-2024-54198 |
| 3504390 | NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.5 | CVE-2024-47586 |
| 3542543 | Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview) New | SAP NetWeaver Administrator | High | 7.2 | CVE-2024-54197 |
| 3351041 | XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2024-47582 |
| 3524933 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | Medium | 5.3 | CVE-2024-32732 |
| 3433545 | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform Update | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2024-42375, CVE-2024-28166, CVE-2024-41731 |
| 3515653 | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2024-42375, CVE-2024-28166, CVE-2024-41731 |
| 3522332 | Missing Authorization check in SAP HCM (Approve Timesheets version 4) New | SAP HCM | Medium | 4.3 | CVE-2024-47581 |
| 3536361 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2024-47585 |
| 3504847 | DLL Hijacking vulnerability in SAP Product Lifecycle Costing New | SAP Product Lifecycle Costing | Low | 3.3 | CVE-2024-47576 |
| 3535451 | Information Disclosure vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Low | 2.7 | CVE-2024-47577 |