At SNOK, every month we analyse the latest SAP security updates to help our clients protect their systems against the latest threats. In the May Patch Day edition, SAP published 15 new security notes, including 2 “HotNews” of the highest priority.
Key Updates
1. SAP CX Commerce – HotNews
- SAP Note 3455438: Addresses two critical vulnerabilities in the Swagger UI and Apache Calcite Avatica libraries. Immediate update of the HY_COM component is recommended.
2. SAP Content Server – HotNews
- SAP Note 3448171: Contains a significant fix preventing the possibility of uploading a malicious file. Users must implement these fixes manually.
Cross-Site Scripting (XSS) Vulnerabilities
The May updates included four new notes addressing XSS vulnerabilities:
-
SAP Note 3431794: Affects SAP BusinessObjects.
-
SAP Note 3448445: Affects SAP NetWeaver.
-
SAP Note 3460772: Affects SAP S/4HANA.
-
SAP Note 3450286: Also related to SAP NetWeaver.
Medium- and Low-Priority Vulnerabilities
1. PDFViewer in SAPUI5
- SAP Note 3446076: The vulnerabilities may lead to the execution of malicious scripts. Introducing the ‘isTrustedSource’ property can reduce the risk, but may affect the user experience.
2. Other Vulnerabilities
-
SAP Note 3392049: Missing authorisation check in SAP Bank Account Management.
-
SAP Note 2174651: Potential information disclosure in SAP Process Integration.
Summary
The May SAP security updates cover a broad range of vulnerabilities, from critical to less severe. At SNOK, we recommend our clients regularly review and promptly implement all security updates to ensure continuous protection of their SAP systems.
Conclusions
Patch management is a key element of any cybersecurity strategy. Regular updates not only protect against known threats but also strengthen the entire IT infrastructure. By acting proactively, organisations can significantly reduce the risk associated with cyberattacks. Contact the SNOK team to learn more about our patch management services and comprehensive SAP system protection.
| Note# | Title | Severity | CVSS |
|---|---|---|---|
| 2622660 | Update to Security Note released on April 2018 Patch Day: Security updates for the browser control Google Chromium delivered with SAP Business Client Product - SAP Business Client, Versions - 6.5, 7.0, 7.70 | Hot News | 10.0 |
| 3455438 | CVE-2019-17495 Multiple vulnerabilities in SAP CX Commerce Related CVE - CVE-2022-36364 Product- SAP Commerce, Version - HY_COM 2205 | Hot News | 9.8 |
| 3448171 | CVE-2024-33006 File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform Product- SAP NetWeaver Application Server ABAP and ABAP Platform, Versions - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 | Hot News | 9.6 |
| 3431794 | CVE-2024-28165 Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform Product- SAP BusinessObjects (Business Intelligence Platform), Versions - 430, 440 | High | 8.1 |
| 3441944 | CVE-2024-32730 Missing authorization check in SAP Enable Now Manager Product- SAP Enable Now, Version - 1704 | Medium | 6.5 |
| 3448445 | CVE-2024-34687 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform Product- SAP NetWeaver Application server for ABAP and ABAP Platform, Versions - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795, SAP_BASIS 796 | Medium | 6.5 |
| 3450286 | CVE-2024-32733 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform Product- SAP NetWeaver Application Server ABAP and ABAP Platform, Versions - SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 | Medium | 6.1 |
| 3460772 | CVE-2024-33002 Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS) Product - SAP S/4HANA (Document Service Handler for DPS), Versions - SAP_BASIS 740, SAP_BASIS 750 | Medium | 6.1 |
| 3447467 | CVE-2024-32731Missing Authorization check in SAP My Travel Requests Product- My Travel Requests, Version - 600 | Medium | 5.5 |
| 2745860 | Update to Security Note released on May 2021 Patch Day: Information Disclosure in Enterprise Services Repository of SAP Process Integration Product - SAP Process Integration, Versions - MESSAGING 7.31, MESSAGING 7.40, MESSAGING 7.50, NWCEIDE 7.31, SAP_XIESR 7.31, SAP_XIESR 7.40, SAP_XIESR 7.50, SAP_XITOOL 7.31, SAP_XITOOL 7.40, SAP_XITOOL 7.50, SAP_XIAF 7.31, SAP_XIAF 7.40, SAP_XIAF 7.50, SAP_XIGUILIB 7.31, SAP_XIGUILIB 7.40, SAP_XIGUILIB 7.50 | Medium | 5.3 |
| 3349468 | CVE-2024-33008 Memory Corruption vulnerability in SAP Replication Server Product - SAP Replication Server, Versions - 16.0, 16.0.3, 16.0.4 | Medium | 4.9 |
| 3434666 | [Multiple CVEs]Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) CVEs - CVE-2024-4139, CVE-2024-4138 Product - SAP S/4 HANA (Manage Bank Statement Reprocessing Rules), Versions - SAPSCORE 131, S4CORE 105, S4CORE 106, S4CORE107, S4CORE 108 | Medium | 4.3 |
| 3449093 | CVE-2024-33004 Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices) Product - SAP BusinessObjects Business Intelligence Platform (Webservices), Versions - 430, 440 | Medium | 4.3 |
| 2174651 | Update to Security Note released on December 2017 Patch Day: Potential information disclosure relating to PI Integration Directory Product - SAP Process Integration, Versions - MESSAGING 7.10, MESSAGING 7.11, MESSAGING 7.30, MESSAGING 7.31, MESSAGING 7.40, MESSAGING 7.50, NWCEIDE 7.31, SAP_XITOOL 7.00, SAP_XITOOL 7.01, SAP_XITOOL 7.02, SAP_XITOOL 7.10, SAP_XITOOL 7.11, SAP_XITOOL 7.30, SAP_XITOOL 7.31, SAP_XITOOL 7.40, SAP_XITOOL 7.50, SAP_XIAF 7.31, SAP_XIAF 7.40, SAP_XIAF 7.50, SAP_XIPCK 7.00, SAP_XIPCK 7.01, SAP_XIPCK 7.02, SAP_XIPCK 7.10, SAP_XIPCK 7.11, SAP_XIPCK 7.30 | Medium | 4.3 |
| 1938764 | CVE-2024-33009 SQL injection vulnerability in SAP Global Label Management (GLM) Product - SAP Global Label Management (GLM), Versions - 605, 606, 616, 617 | Low | 3.7 |
| 3392049 | CVE-2024-33000 Missing Authorization check in SAP Bank Account Management Product - SAP Bank Account Management, Versions - 100, 101, 102, 103, 104, 105, 106, 107, 108 | Low | 3.5 |
| 3446076 | CVE-2024-33007 Client-side script execution vulnerability in SAP UI5(PDFViewer) Product - SAPUI5, Versions - 754, 755, 756, 757, 758 | Low | 3.5 |