Patch Day: January 2024
Released January 9, 2024 · 12 notes · Source: SAP Security Patch Day page
Scheduled for January 9, 2024 (second Tuesday)
- New
- 10
- Updated
- 2
- Critical
- 3
- High
- 4
- Highest CVSS
- 9.1
- Known exploited
- 1
Our summary
12 notes (10 new, 2 updated). 3 Critical and 4 High. Highest CVSS 9.1. 1 note(s) fix a CVE that is in the CISA KEV catalog.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Denial of service (DOS) in SAP Web Dispatcher, SAP NetWeaver Application server ABAP, and ABAP Platform
Escalation of Privileges in SAP Business Technology Platform (BTP) Security Services Integration Libraries
Escalation of Privileges in applications developed through SAP Business Application Studio, SAP Web IDE Full-Stack and SAP Web IDE for SAP HANA
Escalation of Privileges in SAP Edge Integration Cell
Code Injection vulnerability in SAP Application Interface Framework (File Adapter)
All notes
SAP’s introduction states 10 new notes and 2 updates; SAP’s table lists 12 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 12 of 12
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3411067 | Escalation of Privileges in SAP Business Technology Platform (BTP) Security Services Integration Libraries Update | @sap/xssec | Critical | 9.1 | CVE-2023-49583, CVE-2023-50422, CVE-2023-50423, CVE-2023-50424 |
| 3412456 | Escalation of Privileges in applications developed through SAP Business Application Studio, SAP Web IDE Full-Stack and SAP Web IDE for SAP HANA New | @sap/xssec | Critical | 9.1 | CVE-2023-49583 |
| 3413475 | Escalation of Privileges in SAP Edge Integration Cell New | SAP Edge Integration Cell | Critical | 9.1 | CVE-2023-49583, CVE-2023-50422 |
| 3411869 | Code Injection vulnerability in SAP Application Interface Framework (File Adapter) New | SAP Application Interface Framework | High | 8.4 | CVE-2024-21737 |
| 3389917 | Denial of service (DOS) in SAP Web Dispatcher, SAP NetWeaver Application server ABAP, and ABAP Platform NewKnown exploited | SAP Web Dispatcher | High | 7.5 | CVE-2023-44487 |
| 3386378 | Information Disclosure vulnerability in Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) New | Microsoft Edge browser extension | High | 7.4 | CVE-2024-22125 |
| 3407617 | Improper Authorization check in SAP LT Replication Server New | SAP LT Replication Server | High | 7.3 | CVE-2024-21735 |
| 3260667 | Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) New | SAP S/4HANA Finance | Medium | 6.4 | CVE-2024-21736 |
| 3324732 | Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer) Update | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-31405 |
| 3387737 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2024-21738 |
| 3392626 | Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager New | SAP NetWeaver | Medium | 4.1 | CVE-2024-22124 |
| 3190894 | URL Redirection vulnerability in SAP Marketing (Contacts App) New | SAP Marketing | Low | 3.7 | CVE-2024-21734 |