Welcome to another instalment of our “Safe Tuesday with SNOK” series, where we focus on the latest security updates and practices in the SAP world. Today’s article is devoted to the March SAP Security Patch Day, which brings a number of key security updates. Let’s dive into the details to understand which threats have been mitigated and how we can better secure our SAP systems.
What’s new in March?
March brought significant security changes for SAP users, with twelve new and updated security notes, including three HotNews notes and three high-priority notes. Among them was a critical code injection vulnerability in SAP NetWeaver AS Java, as well as three information disclosure vulnerabilities across various applications and components. This underlines the continuing need to monitor and update systems in order to protect against new and evolving threats.
Details of the new high-priority notes
Several key updates stand out in the March release. The HotNews note concerning SAP Business Client and updated Chromium support addresses twenty-nine security vulnerabilities, including two critical ones. In addition, a critical code injection vulnerability in the Administrator Log Viewer plug-in of SAP NetWeaver AS Java was identified as a potential threat that allows an attacker to execute arbitrary commands on the system. The patch provides an extended list of prohibited file types and recommends enabling virus scanning for uploaded files as an additional security measure.
Why does this matter for SNOK and our clients?
SAP security updates are a key element of any cyberthreat protection strategy. For SNOK and our clients, keeping SAP systems up to date is not merely a matter of compliance, but above all a matter of protecting sensitive data and ensuring business continuity. Critical vulnerabilities such as those identified in the March notes can lead to unauthorised access, data leaks, or even system downtime, which underlines the importance of responding quickly to published updates.
How does SNOK help clients manage patches?
At SNOK, we understand that patch and security update management can be a complex and time-consuming task. That is why we support our clients in identifying, testing and deploying critical SAP security updates. Our services include monitoring published security notes, assessing the risk associated with vulnerabilities, and providing recommendations on prioritisation and deployment of patches.
Thanks to our experience and specialist expertise, SNOK’s clients can focus on their core business activities, confident that their SAP systems are protected against the latest threats. Our integrated approach to security management helps minimise risk and ensures that systems are always up to date and properly secured.
At SNOK, we are committed to providing the highest level of security for our clients, monitoring the continuous changes in the cybersecurity landscape and adapting our strategies to effectively manage and mitigate potential threats. Our dedication in the field of SAP and cybersecurity allows clients to run their business safely and efficiently, knowing that their systems are protected by security experts.
Summary and conclusions
March brought twelve new and updated SAP security notes, a below-average figure. However, three HotNews notes and three high-priority notes require particular attention, including two that were only updated. This is a reminder for all of us of the continuing need to monitor and update our SAP systems to ensure their security against evolving threats.
At SNOK, we are aware of how important it is to maintain the security of our SAP systems. That is why we continuously track and analyse the latest updates and practices in the field of security, so that our community can stay one step ahead of potential threats. Remember that security is a process, not a destination, and requires continuous attention and commitment.
We hope that today’s article has provided valuable information and will help you maintain the security of your SAP systems. See you in the next “Safe Tuesday with SNOK”!
SAP Note Type Description Priority CVSS
3433192 New [CVE-2024-22127] Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
BC-JAS-ADM-LOG HotNews 9.1
3417399 New [CVE-2024-22133] Improper Access Control in SAP Fiori Front End Server
PA-FIO-LEA Medium 4.6
3377979 New [CVE-2024-27902] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP, applications based on SAPGUI for HTML (WebGUI)
BC-FES-WGU Medium 5.4
3434192 New [CVE-2024-28163] Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)
BC-XI-IBF-UI Medium 5.3
3425274 New [CVE-2019-10744] Code Injection vulnerability in applications built with SAP Build Apps
CA-LCA-ACP HotNews 9.4
3425682 New [CVE-2024-25644] Information Disclosure vulnerability in SAP NetWeaver (WSRM)
BC-ESI-WS-JAV-RT Medium 5.3
3428847 New [CVE-2024-25645] Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)
EP-PIN-APF-OPR Medium 5.3
3414195 New [CVE-2023-50164] Path Traversal Vulnerability in SAP BusinessObjects Business Intelligence Platform (Central Management Console)
BI-BIP-CMC High 7.2
3410615 New [CVE-2023-44487 ] Denial of service (DOS) in SAP HANA XS Classic and HANA XS Advanced
HAN-AS-XS High 7.5
2622660 Update Security updates for the browser control Google Chromium delivered with SAP Business Client
BC-FES-BUS-DSK HotNews 10.0
3419022 New [CVE-2024-27900]Missing Authorization check in SAP ABAP Platform
BC-SRV-APS-APJ Medium 4.3
3346500 Update [CVE-2023-39439] Improper authentication in SAP Commerce Cloud
CEC-SCC-PLA-PL High 8.8