# Safe Tuesday with SNOK: Key Updates from the May SAP Patch Day

> At SNOK, every month we analyse the latest SAP security updates to help our clients protect their systems against the latest threats. In the May Patch Day…

- Source: https://snok.ai/en/news/blog/may-sap-patch-day-key-updates/
- Author: Jacek Bugajski
- Published: 2024-05-15

---
At SNOK, every month we analyse the latest [SAP](https://snok.ai/en/news/blog/prepare-sap-s4hana-conversion-rise/) security updates to help our clients protect their systems against the latest threats. In the May [Patch Day](https://snok.ai/en/news/blog/sap-security-patch-day-september-2024/) edition, SAP published 15 new security notes, including 2 "HotNews" of the highest priority.

## Key Updates

**1. SAP CX Commerce – HotNews**

- SAP Note 3455438: Addresses two critical vulnerabilities in the Swagger UI and Apache Calcite Avatica libraries. Immediate update of the HY_COM component is recommended.

**2. SAP Content Server – HotNews**

- SAP Note 3448171: Contains a significant fix preventing the possibility of uploading a malicious file. Users must implement these fixes manually.

## Cross-Site Scripting (XSS) Vulnerabilities

The May updates included four new notes addressing XSS vulnerabilities:

- SAP Note 3431794: Affects SAP BusinessObjects.

- SAP Note 3448445: Affects SAP NetWeaver.

- SAP Note 3460772: Affects SAP S/4HANA.

- SAP Note 3450286: Also related to SAP NetWeaver.

## Medium- and Low-Priority Vulnerabilities

**1. PDFViewer in SAPUI5**

- SAP Note 3446076: The vulnerabilities may lead to the execution of malicious scripts. Introducing the 'isTrustedSource' property can reduce the risk, but may affect the user experience.

**2. Other Vulnerabilities**

- SAP Note 3392049: Missing authorisation check in SAP Bank Account Management.

- SAP Note 2174651: Potential information disclosure in SAP Process Integration.

## Summary

The May SAP security updates cover a broad range of vulnerabilities, from critical to less severe. At SNOK, we recommend our clients regularly review and promptly implement all security updates to ensure continuous protection of their SAP systems.

## Conclusions

Patch management is a key element of any cybersecurity strategy. Regular updates not only protect against known threats but also strengthen the entire IT infrastructure. By acting proactively, organisations can significantly reduce the risk associated with cyberattacks. Contact the SNOK team to learn more about our patch management services and comprehensive SAP system protection.

| Note# | Title | Severity | CVSS |
|---|---|---|---|
| [2622660](https://me.sap.com/notes/2622660) | **Update to Security Note released on April 2018 Patch Day:** **Security updates for the browser control Google Chromium delivered with SAP Business Client** Product - SAP Business Client, Versions - 6.5, 7.0, 7.70 | Hot News | [10.0](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) |
| [3455438](https://me.sap.com/notes/3455438) | [CVE-2019-17495](https://www.cve.org/CVERecord?id=CVE-2019-17495) **Multiple vulnerabilities in SAP CX Commerce** Related CVE - [CVE-2022-36364](https://www.cve.org/CVERecord?id=CVE-2022-36364) Product- SAP Commerce, Version - HY_COM 2205 | Hot News | [9.8](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| [3448171](https://me.sap.com/notes/3448171) | [CVE-2024-33006](https://www.cve.org/CVERecord?id=CVE-2024-33006) **File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform** Product- SAP NetWeaver Application Server ABAP and ABAP Platform, Versions - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 | Hot News | [9.6](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) |
| [3431794](https://me.sap.com/notes/3431794) | [CVE-2024-28165](https://www.cve.org/CVERecord?id=CVE-2024-28165) **Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform** Product- SAP BusinessObjects (Business Intelligence Platform), Versions - 430, 440 | High | [8.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) |
| [3441944](https://me.sap.com/notes/3441944) | [CVE-2024-32730](https://www.cve.org/CVERecord?id=CVE-2024-32730) **Missing authorization check in SAP Enable Now Manager** Product- SAP Enable Now, Version - 1704 | Medium | [6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) |
| [3448445](https://me.sap.com/notes/3448445) | [CVE-2024-34687](https://www.cve.org/CVERecord?id=CVE-2024-34687) **Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform** Product- SAP NetWeaver Application server for ABAP and ABAP Platform, Versions - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795, SAP_BASIS 796 | Medium | [6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) |
| [3450286](https://me.sap.com/notes/3450286) | [CVE-2024-32733](https://www.cve.org/CVERecord?id=CVE-2024-32733) **Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform** Product- SAP NetWeaver Application Server ABAP and ABAP Platform, Versions - SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 | Medium | [6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |
| [3460772](https://me.sap.com/notes/3460772) | [CVE-2024-33002](https://www.cve.org/CVERecord?id=CVE-2024-33002) **Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)** Product - SAP S/4HANA (Document Service Handler for DPS), Versions - SAP_BASIS 740, SAP_BASIS 750 | Medium | [6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |
| [3447467](https://me.sap.com/notes/3447467) | [CVE-2024-32731](https://www.cve.org/CVERecord?id=CVE-2024-32731)**Missing Authorization check in SAP My Travel Requests** Product- My Travel Requests, Version - 600 | Medium | [5.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) |
| [2745860](https://me.sap.com/notes/2745860) | **Update to Security Note released on May 2021 Patch Day:** **Information Disclosure in Enterprise Services Repository of SAP Process Integration** Product - SAP Process Integration, Versions - MESSAGING 7.31, MESSAGING 7.40, MESSAGING 7.50, NWCEIDE 7.31, SAP_XIESR 7.31, SAP_XIESR 7.40, SAP_XIESR 7.50, SAP_XITOOL 7.31, SAP_XITOOL 7.40, SAP_XITOOL 7.50, SAP_XIAF 7.31, SAP_XIAF 7.40, SAP_XIAF 7.50, SAP_XIGUILIB 7.31, SAP_XIGUILIB 7.40, SAP_XIGUILIB 7.50 | Medium | [5.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |
| [3349468](https://me.sap.com/notes/3349468) | [CVE-2024-33008](https://www.cve.org/CVERecord?id=CVE-2024-33008) **Memory Corruption vulnerability in SAP Replication Server** Product - SAP Replication Server, Versions - 16.0, 16.0.3, 16.0.4 | Medium | [4.9](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) |
| [3434666](https://me.sap.com/notes/3434666) | [**Multiple CVEs**]**Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)** CVEs - [CVE-2024-4139](https://www.cve.org/CVERecord?id=CVE-2024-4139), [CVE-2024-4138](https://www.cve.org/CVERecord?id=CVE-2024-4138) Product - SAP S/4 HANA (Manage Bank Statement Reprocessing Rules), Versions - SAPSCORE 131, S4CORE 105, S4CORE 106, S4CORE107, S4CORE 108 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) |
| [3449093](https://me.sap.com/notes/3449093) | [CVE-2024-33004](https://www.cve.org/CVERecord?id=CVE-2024-33004) **Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)** Product - SAP BusinessObjects Business Intelligence Platform (Webservices), Versions - 430, 440 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) |
| [2174651](https://me.sap.com/notes/2174651) | **Update to Security Note released on December 2017 Patch Day:** **Potential information disclosure relating to PI Integration Directory** Product - SAP Process Integration, Versions - MESSAGING 7.10, MESSAGING 7.11, MESSAGING 7.30, MESSAGING 7.31, MESSAGING 7.40, MESSAGING 7.50, NWCEIDE 7.31, SAP_XITOOL 7.00, SAP_XITOOL 7.01, SAP_XITOOL 7.02, SAP_XITOOL 7.10, SAP_XITOOL 7.11, SAP_XITOOL 7.30, SAP_XITOOL 7.31, SAP_XITOOL 7.40, SAP_XITOOL 7.50, SAP_XIAF 7.31, SAP_XIAF 7.40, SAP_XIAF 7.50, SAP_XIPCK 7.00, SAP_XIPCK 7.01, SAP_XIPCK 7.02, SAP_XIPCK 7.10, SAP_XIPCK 7.11, SAP_XIPCK 7.30 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) |
| [1938764](https://me.sap.com/notes/1938764) | [CVE-2024-33009](https://www.cve.org/CVERecord?id=CVE-2024-33009) **SQL injection vulnerability in SAP Global Label Management (GLM)** Product - SAP Global Label Management (GLM), Versions - 605, 606, 616, 617 | Low | [3.7](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) |
| [3392049](https://me.sap.com/notes/3392049) | [CVE-2024-33000](https://www.cve.org/CVERecord?id=CVE-2024-33000) **Missing Authorization check in SAP Bank Account Management** Product - SAP Bank Account Management, Versions - 100, 101, 102, 103, 104, 105, 106, 107, 108 | Low | [3.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) |
| [3446076](https://me.sap.com/notes/3446076) | [CVE-2024-33007](https://www.cve.org/CVERecord?id=CVE-2024-33007) **Client-side script execution vulnerability in SAP UI5(PDFViewer)** Product - SAPUI5, Versions - 754, 755, 756, 757, 758 | Low | [3.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) |