Patch Day: February 2025
Released February 11, 2025 · 21 notes · Source: SAP Security Patch Day page
Scheduled for February 11, 2025 (second Tuesday)
- New
- 19
- Updated
- 2
- Critical
- 0
- High
- 6
- Highest CVSS
- 8.8
- Known exploited
- 0
Our summary
21 notes (19 new, 2 updated). 0 Critical and 6 High. Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application)
Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)
Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
Authentication bypass via authorization code injection in SAP Approuter
Multiple vulnerabilities in SAP Enterprise Project Connection
All notes
SAP’s introduction states 19 new notes and 2 updates; SAP’s table lists 21 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 21 of 21
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3417627 | Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application) Update | SAP NetWeaver AS Java | High | 8.8 | CVE-2024-22126 |
| 3525794 | Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console) New | SAP BusinessObjects BI Platform | High | 8.7 | CVE-2025-0064 |
| 3567551 | Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) New | SAP Supplier Relationship Management | High | 8.6 | CVE-2025-25243 |
| 3567974 | Authentication bypass via authorization code injection in SAP Approuter New | @sap/approuter | High | 8.1 | CVE-2025-24876 |
| 3567172 | Multiple vulnerabilities in SAP Enterprise Project Connection New | SAP Enterprise Project Connection | High | 7.5 | CVE-2024-38819, CVE-2024-38820, CVE-2024-38828 |
| 3563929 | Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services) New | SAP HANA extended application services, advanced model | High | 7.1 | CVE-2025-24868 |
| 3555364 | SameSite Defense in Depth not applied for some cookies in SAP Commerce New | SAP Commerce Cloud | Medium | 6.8 | CVE-2025-24875 |
| 3559510 | Missing Defense in Depth Against Clickjacking in SAP Commerce (Backoffice) New | SAP Commerce Cloud | Medium | 6.8 | CVE-2025-24874 |
| 3445708 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad) New | SAP BusinessObjects BI Platform | Medium | 6.1 | CVE-2025-24867 |
| 3557138 | Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application) New | SAP NetWeaver AS Java | Medium | 6.1 | CVE-2024-22126 |
| 3562336 | Insecure Key & Secret Management vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 6.0 | CVE-2025-24870 |
| 3540273 | Multiple vulnerabilities in Apache Solr within SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.5 | CVE-2024-45216, CVE-2024-45217 |
| 3526203 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.4 | CVE-2025-0054 |
| 3532025 | Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests) New | SAP Fiori Apps Reference Library | Medium | 5.4 | CVE-2025-25241 |
| 3287784 | Improper Access Control in SAP NetWeaver AS Java for Deploy Service Update | SAP NetWeaver AS Java for Deploy Service | Medium | 5.3 | CVE-2023-24527 |
| 3546470 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2025-23187, CVE-2025-23189 |
| 3561264 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2025-23193 |
| 3547581 | Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-23190 |
| 3550027 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 4.3 | CVE-2025-24869 |
| 3553753 | Missing Authorization check in SAP ABAP Platform (ABAP Build Framework) New | SAP ABAP Platform | Medium | 4.3 | CVE-2025-24872 |
| 3426825 | Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP New | SAP Fiori for SAP ERP | Low | 3.1 | CVE-2025-23191 |