补丁日：2024年8月
发布于 2024年8月13日 · 25 条安全说明 · 来源：SAP 安全补丁日页面
计划日期：2024年8月13日（每月第二个星期二）
- 新发布
- 17
- 更新
- 8
- 严重
- 2
- 高
- 4
- 最高 CVSS
- 9.8
- 已被利用
- 0
本月摘要
共 25 条安全说明（新发布 17 条，更新 8 条），其中严重 2 条、高 4 条，最高 CVSS 9.8。
优先修补
排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。
Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
Server-Side Request Forgery vulnerability in applications built with SAP Build Apps
XML injection in SAP BEx Web Java Runtime Export Web Service
Prototype Pollution in SAP S/4 HANA (Manage Supply Protection)
Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)
全部安全说明
SAP 简介中写明 17 条新安全说明和 8 条更新；SAP 表格共列出 25 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。
SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。
显示 25 / 25
| 标题 | CVE | ||||
|---|---|---|---|---|---|
| 3479478 | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform 新发布 | SAP BusinessObjects BI Platform | 严重 | 9.8 | CVE-2024-41730 |
| 3477196 | Server-Side Request Forgery vulnerability in applications built with SAP Build Apps 新发布 | SAP Build Apps | 严重 | 9.1 | CVE-2024-29415 |
| 3485284 | XML injection in SAP BEx Web Java Runtime Export Web Service 新发布 | SAP BEx Web Java Runtime Export Web Service | 高 | 8.2 | CVE-2024-42374 |
| 3423268 | Prototype Pollution in SAP S/4 HANA (Manage Supply Protection) 新发布 | SAP S/4 HANA, Library | 高 | 7.8 | CVE-2023-30533 |
| 3460407 | Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) 更新 | SAP NetWeaver AS Java | 高 | 7.5 | CVE-2024-34688 |
| 3459935 | Information Disclosure Vulnerability in SAP Commerce Cloud 新发布 | SAP Commerce Cloud | 高 | 7.4 | CVE-2024-33003 |
| 3466801 | Information Disclosure vulnerability in SAP Landscape Management 更新 | SAP Landscape Management | 中 | 6.9 | CVE-2024-39593 |
| 3459379 | Unrestricted file upload in SAP Document Builder (HTTP service) 更新 | SAP Document Builder | 中 | 6.5 | CVE-2024-34683 |
| 3474590 | Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework 新发布 | SAP Shared Service Framework | 中 | 6.5 | CVE-2024-42376, CVE-2024-42377 |
| 3495876 | Multiple vulnerabilities in SAP Replication Server (FOSS) 新发布 | SAP Replication Server | 中 | 6.5 | CVE-2023-0215, CVE-2022-0778, CVE-2023-0286 |
| 3438085 | Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java), SAP Web Dispatcher and SAP Content Server 新发布 | SAP NetWeaver Application Server (ABAP and Java), SAP Web Dispatcher and SAP Content Server | 中 | 6.3 | CVE-2024-33005 |
| 3482217 | Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation 更新 | SAP Business Warehouse - Business Planning and Simulation | 中 | 6.1 | CVE-2024-39594 |
| 3465455 | Missing Authorization check in SAP BW/4HANA Transformation and DTP 更新 | SAP BW/4HANA Transformation and Data Transfer Process | 中 | 5.5 | CVE-2024-37176 |
| 3483256 | Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice 新发布 | SAP Commerce Backoffice | 中 | 5.4 | CVE-2024-41735 |
| 3471450 | Information Disclosure Vulnerability in SAP Commerce 新发布 | SAP Commerce Cloud | 中 | 5.3 | CVE-2024-41733 |
| 3458789 | Server-Side Request Forgery in SAP Business Workflow (WebFlow Services) 更新 | SAP Business Workflow | 中 | 5.0 | CVE-2024-34689 |
| 3487537 | Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management) 新发布 | SAP CRM ABAP | 中 | 5.0 | CVE-2024-41737 |
| 3468102 | Improper Access Control in SAP Netweaver Application Server ABAP 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.7 | CVE-2024-41732 |
| 3150704 | Information Disclosure in SAP Bank Account Management (Manage Banks) 更新 | SAP Bank Account Management | 中 | 4.5 | CVE-2023-0023 |
| 3433545 | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform 新发布 | SAP BusinessObjects BI Platform | 中 | 4.3 | CVE-2024-42375, CVE-2024-28166, CVE-2024-41731 |
| 3475427 | Information Disclosure vulnerability in SAP Permit to Work 新发布 | SAP Permit to Work | 中 | 4.3 | CVE-2024-41736 |
| 3477423 | Missing Authorization check in SAP Document Builder 新发布 | SAP Document Builder | 中 | 4.3 | CVE-2024-39591 |
| 3479293 | Missing Authorization Check in SAP Student Life Cycle Management (SLcM) 新发布 | SAP Student Life Cycle Management | 中 | 4.3 | CVE-2024-42373 |
| 3494349 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.3 | CVE-2024-41734 |
| 3454858 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform 更新 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.1 | CVE-2024-37180 |