Patch Day: June 2024
Released June 11, 2024 · 13 notes · Source: SAP Security Patch Day page
Scheduled for June 11, 2024 (second Tuesday)
- New
- 10
- Updated
- 3
- Critical
- 0
- High
- 2
- Highest CVSS
- 8.1
- Known exploited
- 0
Our summary
13 notes (10 new, 3 updated). 0 Critical and 2 High. Highest CVSS 8.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)
All notes
SAP’s introduction states 10 new notes and 3 updates; SAP’s table lists 13 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 13 of 13
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3457592 | Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation New | SAP Financial Consolidation | High | 8.1 | CVE-2024-37177, CVE-2024-37178 |
| 3460407 | Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) New | SAP NetWeaver AS Java | High | 7.5 | CVE-2024-34688 |
| 3453170 | Denial of service (DOS) in SAP NetWeaver and ABAP platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2024-33001 |
| 3459379 | Unrestricted file upload in SAP Document Builder (HTTP service) New | SAP Document Builder | Medium | 6.5 | CVE-2024-34683 |
| 3466175 | Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) New | SAP S/4HANA | Medium | 6.5 | CVE-2024-34691 |
| 3450286 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2024-32733 |
| 3465129 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM WebClient UI | Medium | 6.1 | CVE-2024-34686 |
| 3465455 | Missing Authorization check in SAP BW/4HANA Transformation and DTP New | SAP BW/4HANA Transformation and Data Transfer Process | Medium | 5.5 | CVE-2024-37176 |
| 3457265 | Missing Authorization check in SAP Student Life Cycle Management (SLcM) New | SAP Student Life Cycle Management | Medium | 5.4 | CVE-2024-34690 |
| 3425571 | Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2024-28164 |
| 2638217 | Switchable Authorization Checks in Central Finance Infrastructure Components Update | Central Finance Infrastructure Components | Low | 3.9 | No CVE |
| 3441817 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling) New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2024-34684 |
| 3392049 | Missing Authorization check in SAP Bank Account Management Update | SAP Bank Account Management | Low | 3.5 | CVE-2024-33000 |