Patch Day: March 2024
Released March 12, 2024 · 12 notes · Source: SAP Security Patch Day page
Scheduled for March 12, 2024 (second Tuesday)
- New
- 10
- Updated
- 2
- Critical
- 3
- High
- 3
- Highest CVSS
- 10.0
- Known exploited
- 1
Our summary
12 notes (10 new, 2 updated). 3 Critical and 3 High. Highest CVSS 10.0. 1 note(s) fix a CVE that is in the CISA KEV catalog.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Denial of service (DOS) in SAP HANA XS Classic and HANA XS Advanced
Security updates for the browser control Google Chromium delivered with SAP Business Client
Code Injection vulnerability in applications built with SAP Build Apps
Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
Improper authentication in SAP Commerce Cloud
All notes
SAP’s introduction states 10 new notes and 2 updates; SAP’s table lists 12 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 12 of 12
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3425274 | Code Injection vulnerability in applications built with SAP Build Apps New | SAP Build Apps | Critical | 9.4 | CVE-2019-10744 |
| 3433192 | Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) New | SAP NetWeaver AS Java | Critical | 9.1 | CVE-2024-22127 |
| 3346500 | Improper authentication in SAP Commerce Cloud Update | SAP Commerce Cloud | High | 8.8 | CVE-2023-39439 |
| 3410615 | Denial of service (DOS) in SAP HANA XS Classic and HANA XS Advanced NewKnown exploited | SAP HANA Database | High | 7.5 | CVE-2023-44487 |
| 3414195 | Path Traversal Vulnerability in SAP BusinessObjects Business Intelligence Platform (Central Management Console) New | SAP BusinessObjects BI Platform | High | 7.2 | CVE-2023-50164 |
| 3377979 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP, applications based on SAPGUI for HTML (WebGUI) New | SAP NetWeaver AS ABAP applications based on SAPGUI for HTML | Medium | 5.4 | CVE-2024-27902 |
| 3425682 | Information Disclosure vulnerability in SAP NetWeaver (WSRM) New | NetWeaver | Medium | 5.3 | CVE-2024-25644 |
| 3428847 | Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal) New | SAP NetWeaver | Medium | 5.3 | CVE-2024-25645 |
| 3434192 | Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages) New | SAP NetWeaver Process Integration | Medium | 5.3 | CVE-2024-28163 |
| 3417399 | Improper Access Control in SAP Fiori Front End Server New | SAP Fiori Front End Server | Medium | 4.6 | CVE-2024-22133 |
| 3419022 | Missing Authorization check in SAP ABAP Platform New | SAP ABAP Platform | Medium | 4.3 | CVE-2024-27900 |