# Bezpieczny wtorek ze SNOK: Kluczowe aktualizacje z sierpniowego SAP Security Patch Day

> 13 sierpnia 2024 roku, w ramach SAP Security Patch Day, opublikowano 17 nowych not bezpieczeństwa oraz zaktualizowano 8 wcześniejszych. Wśród…

- Source: https://snok.ai/pl/aktualnosci/blog/bezpieczny-wtorek-ze-snok-kluczowe-aktualizacje-z-sierpniowego-sap-security-patc/
- Author: Jacek Bugajski
- Published: 2024-08-13

---
13 sierpnia 2024 roku, w ramach [SAP](https://snok.ai/pl/aktualnosci/blog/technologiczny-czwartek-ze-snok-jak-przygotowac-sie-do-konwersji-systemu-sap-erp/) Security Patch Day, opublikowano 17 nowych not bezpieczeństwa oraz zaktualizowano 8 wcześniejszych. Wśród najważniejszych aktualizacji znalazły się:

- CVE-2024-41730: Brak weryfikacji uwierzytelnienia w SAP BusinessObjects Business Intelligence Platform. Ocena CVSS: 9.8 (Hot News).

- CVE-2024-29415: Luka Server-Side Request Forgery w SAP Build Apps. Ocena CVSS: 9.1 (Hot News).

- CVE-2024-42374: Możliwość wstrzyknięcia XML w SAP BEx Web Java Runtime Export Web Service. Ocena CVSS: 8.2 (High).

| Note# | Title | Priority | CVSS |
|---|---|---|---|
| [3479478](https://me.sap.com/notes/3479478) | [CVE-2024-41730](https://www.cve.org/CVERecord?id=CVE-2024-41730) **Missing Authentication check in SAP BusinessObjects Business Intelligence Platform** Product - SAP BusinessObjects Business Intelligence Platform, Version - ENTERPRISE 430, 440 | Hot News | [9.8](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| [3477196](https://me.sap.com/notes/3477196) | [CVE-2024-29415](https://www.cve.org/CVERecord?id=CVE-2024-29415) **Server-Side Request Forgery vulnerability in applications built with SAP Build Apps** Product - SAP Build Apps, Versions < 4.11.130 | Hot News | [9.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) |
| [3485284](https://me.sap.com/notes/3485284) | [CVE-2024-42374](https://www.cve.org/CVERecord?id=CVE-2024-42374) **XML injection in SAP BEx Web Java Runtime Export Web Service** Product- SAP BEx Web Java Runtime Export Web Service, Versions - BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5, BIWEBAPP 7.5 | High | [8.2](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) |
| [3423268](https://me.sap.com/notes/3423268) | [CVE-2023-30533](https://www.cve.org/CVERecord?id=CVE-2023-30533) **Prototype Pollution in SAP S/4 HANA (Manage Supply Protection)** Product- SAP S/4 HANA, Library Versions - SheetJS CE < 0.19.3 | High | [7.8](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) |
| [3460407](https://me.sap.com/notes/3460407) | **Update to Security Note released on June 2024 Patch Day:** [CVE-2024-34688](https://www.cve.org/CVERecord?id=CVE-2024-34688) **Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)** Product- SAP NetWeaver AS Java, Version - MMR_SERVER 7.5 | High | [7.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| [3459935](https://me.sap.com/notes/3459935) | [CVE-2024-33003](https://www.cve.org/CVERecord?id=CVE-2024-33003) **Information Disclosure Vulnerability in SAP Commerce Cloud** Product- SAP Commerce Cloud, Versions - HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205, COM_CLOUD 2211 | High | [7.4](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) |
| [3466801](https://me.sap.com/notes/3466801) | **Update to Security Note released on July 2024 Patch Day:** [CVE-2024-39593](https://www.cve.org/CVERecord?id=CVE-2024-39593) **Information Disclosure vulnerability in SAP Landscape Management** Product- SAP Landscape Management, Version - VCM 3.00 | Medium | [6.9](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) |
| [3495876](https://me.sap.com/notes/3495876) | **[Multiple CVEs] Multiple vulnerabilities in SAP Replication Server (FOSS)** CVEs - [CVE-2023-0215](https://www.cve.org/CVERecord?id=CVE-2023-0215), [CVE-2022-0778](https://www.cve.org/CVERecord?id=CVE-2022-0778) , [CVE-2023-0286](https://www.cve.org/CVERecord?id=CVE-2023-0286) Product- SAP Replication Server, Versions - 16.0.3, 16.0.4 | Medium | [6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) |
| [3459379](https://me.sap.com/notes/3459379) | **Update to Security Note released on June 2024 Patch Day:** [CVE-2024-34683](https://www.cve.org/CVERecord?id=CVE-2024-34683) **Unrestricted file upload in SAP Document Builder (HTTP service)** Product - SAP Document Builder, Versions - S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747, 748 | Medium | [6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) |
| [3474590](https://me.sap.com/notes/3474590) | [CVE-2024-42376](https://www.cve.org/CVERecord?id=CVE-2024-42376) **Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework** Product- SAP Shared Service Framework, Versions - SAP_BS_FND 702, 731, 746, 747, 748 | Medium | [6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) |
| [3438085](https://me.sap.com/notes/3438085) | [CVE-2024-33005](https://www.cve.org/CVERecord?id=CVE-2024-33005) **Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java), SAP Web Dispatcher and SAP Content Server** Product- SAP NetWeaver Application Server (ABAP and Java), SAP Web Dispatcher and SAP Content Server, Versions - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.53, 7.77, 7.85, 7.22_EXT, 7.89, 7.54, 7.93, KERNEL 7.22, 7.53, 7.77, 7.85, 7.89, 7.54, 7.93 | Medium | [6.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) |
| [3482217](https://me.sap.com/notes/3482217) | **Update to Security Note released on July 2024 Patch Day:** [CVE-2024-39594](https://www.cve.org/CVERecord?id=CVE-2024-39594) **Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation** Product- SAP Business Warehouse - Business Planning and Simulation, Versions - SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, SAP_BW_VIRTUAL_COMP 701 | Medium | [6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |
| [3465455](https://me.sap.com/notes/3465455) | **Update to Security Note released on June 2024 Patch Day:** [CVE-2024-37176](https://www.cve.org/CVERecord?id=CVE-2024-37176) **Missing Authorization check in SAP BW/4HANA Transformation and DTP** Product- SAP BW/4HANA Transformation and Data Transfer Process, Versions - DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 | Medium | [5.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L) |
| [3483256](https://me.sap.com/notes/3483256) | [CVE-2024-41735](https://www.cve.org/CVERecord?id=CVE-2024-41735) **Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice** Product - SAP Commerce Backoffice, Version - HY_COM 2205 | Medium | [5.4](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) |
| [3471450](https://me.sap.com/notes/3471450) | [CVE-2024-41733](https://www.cve.org/CVERecord?id=CVE-2024-41733) **Information Disclosure Vulnerability in SAP Commerce** Product - SAP Commerce, Versions - HY_COM 2205, COM_CLOUD 2211 | Medium | [5.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |
| [3487537](https://me.sap.com/notes/3487537) | [CVE-2024-41737](https://www.cve.org/CVERecord?id=CVE-2024-41737) **Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)** Product - SAP CRM ABAP (Insights Management), Versions - BBPCRM 700, 701, 702, 712, 713, 714 | Medium | [5.0](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) |
| [3458789](https://me.sap.com/notes/3458789) | **Update to Security Note released on July 2024 Patch Day:** [CVE-2024-34689](https://www.cve.org/CVERecord?id=CVE-2024-34689) **Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)** Product- SAP Business Workflow (WebFlow Services), Versions - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 | Medium | [5.0](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) |
| [3468102](https://me.sap.com/notes/3468102) | [CVE-2024-41732](https://www.cve.org/CVERecord?id=CVE-2024-41732)**Improper Access Control in SAP Netweaver Application Server ABAP** Product - SAP NetWeaver Application Server ABAP, Versions - SAP_UI 754, 755, 756, 757, 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 912 | Medium | [4.7](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) |
| [3150704](https://me.sap.com/notes/3150704) | **Update to Security Note released on January 2023 Patch Day:** [CVE-2023-0023](https://www.cve.org/CVERecord?id=CVE-2023-0023)**Information Disclosure in SAP Bank Account Management (Manage Banks)** Product - SAP Bank Account Management (Manage Banks), Versions - 800, 900 | Medium | [4.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) |
| [3433545](https://me.sap.com/notes/3433545) | [CVE-2024-42375](https://www.cve.org/CVERecord?id=CVE-2024-42375) **Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform** Additional CVE - [CVE-2024-28166](https://www.cve.org/CVERecord?id=CVE-2024-28166), [CVE-2024-41731](https://www.cve.org/CVERecord?id=CVE-2024-41731) Product - SAP BusinessObjects Business Intelligence Platform, Versions - ENTERPRISE 420, 430, 440 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) |
| [3475427](https://me.sap.com/notes/3475427) | [CVE-2024-41736](https://www.cve.org/CVERecord?id=CVE-2024-41736) **Information Disclosure vulnerability in SAP Permit to Work** Product - SAP Permit to Work, Versions - UIS4HOP1 800, 900 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) |
| [3477423](https://me.sap.com/notes/3477423) | [CVE-2024-39591](https://www.cve.org/CVERecord?id=CVE-2024-39591) **Missing Authorization check in SAP Document Builder** Product - SAP Document Builder, Versions - S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, SAP_BS_FND 702, SAP_BS_FND 731, SAP_BS_FND 746, SAP_BS_FND 747, SAP_BS_FND 748 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) |
| [3479293](https://me.sap.com/notes/3479293) | [CVE-2024-42373](https://www.cve.org/CVERecord?id=CVE-2024-42373) **Missing Authorization Check in SAP Student Life Cycle Management (SLcM)** Product - SAP Student Life Cycle Management (SLcM), Versions - IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807, 808 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) |
| [3494349](https://me.sap.com/notes/3494349) | [CVE-2024-41734](https://www.cve.org/CVERecord?id=CVE-2024-41734) **Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform** Product - SAP NetWeaver Application Server ABAP and ABAP Platform, Versions - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 912 | Medium | [4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) |
| [3454858](https://me.sap.com/notes/3454858) | **Update to Security Note released on July 2024 Patch Day:** [CVE-2024-37180](https://www.cve.org/CVERecord?id=CVE-2024-37180) **Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform** Product- SAP NetWeaver Application Server for ABAP and ABAP Platform, Versions - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 | Medium | [4.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) |

## Rekomendacje SNOK

Jeśli chodzi o zabezpieczenie systemów SAP, najważniejsze jest natychmiastowe wdrożenie aktualizacji z sierpniowego Patch Day. Aktualizacje te eliminują krytyczne luki, które mogą być wykorzystane przez cyberprzestępców. Regularne monitorowanie systemów pozwala na szybkie wykrycie nowych zagrożeń, co z kolei umożliwia błyskawiczne wdrożenie odpowiednich poprawek. Ponadto, warto inwestować w stałe szkolenie zespołów IT. Zrozumienie przez nich najnowszych zagrożeń i metod obrony jest kluczowe dla utrzymania bezpieczeństwa całej infrastruktury. Systemy SAP, ze względu na swoją złożoność i kluczową rolę w organizacjach, wymagają szczególnej uwagi. Dlatego warto zadbać o to, by specjaliści IT byli na bieżąco z najnowszymi zagrożeniami i technologiami zabezpieczeń.

## Podsumowanie

Sierpniowy [SAP Security Patch Day](https://snok.ai/pl/aktualnosci/blog/bezpieczny-wtorek-ze-snok-sap-security-patch-day-wrzesien-2024/) przyniósł szereg ważnych aktualizacji, które mają na celu ochronę systemów przed nowymi zagrożeniami. Każda z tych aktualizacji jest kluczowa dla zabezpieczenia środowiska SAP i powinna być wdrożona jak najszybciej. Ignorowanie takich poprawek może prowadzić do poważnych konsekwencji, takich jak naruszenie danych czy przerwy w działaniu systemów. Warto także pamiętać, że bezpieczeństwo systemów to nie tylko kwestia wdrożenia poprawek, ale także stałej współpracy z ekspertami, którzy pomogą w interpretacji zagrożeń i dostosowaniu odpowiednich środków ochronnych. SNOK oferuje wsparcie na każdym etapie tego procesu, co pozwala na skuteczne i proaktywne zarządzanie bezpieczeństwem w środowisku SAP.