Türkçe 
English 
SAP Security Patch Day – March 2024
This post shares information on Security Notes that remediates vulnerabilities discovered in SAP products. SAP strongly recommends that the customer applies patches on priority to protect their SAP landscape.
On 12th of March 2024, SAP Security Patch Day saw the release of 10 new Security Notes. Further, there were 2 updates to previously released Security Notes.
|
Note# |
Title |
Priority |
CVSS |
|---|---|---|---|
|
Update to Security Note released on April 2018 Patch Day: |
Hot News |
||
|
[CVE-2019-10744] Code Injection vulnerability in applications built with SAP Build Apps Product – SAP Build Apps, Versions < 4.9.145 |
Hot News |
||
|
[CVE-2024-22127] Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) |
Hot News |
||
|
Update to Security Note released on August 2023 Patch Day: [CVE-2023-39439] Improper authentication in SAP Commerce Cloud |
High |
||
|
[CVE-2023-44487] Denial of service (DOS) in SAP HANA XS Classic and HANA XS Advanced Product– SAP HANA Extended Application Services Advanced (XS Advanced), Version – 1.0 |
High |
||
| [CVE-2023-50164] Path Traversal Vulnerability in SAP BusinessObjects Business Intelligence Platform (Central Management Console) Product – SAP BusinessObjects Business Intelligence Platform (Central Management Console), Versions – 4.3 |
High |
||
|
[CVE-2024-27902] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP, applications based on SAPGUI for HTML (WebGUI) |
Medium |
||
|
[CVE-2024-25644] Information Disclosure vulnerability in SAP NetWeaver (WSRM) |
Medium |
||
|
[CVE-2024-25645] Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal) |
Medium |
||
|
[CVE-2024-28163] Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages) |
Medium |
||
|
[CVE-2024-22133] Improper Access Control in SAP Fiori Front End Server |
Medium |
||
|
[CVE-2024-27900] Missing Authorization check in SAP ABAP Platform |
Medium |
To know more about the security researchers and research companies who have contributed for security patches of this month, visit here.
Archived blogs from previous years are available here.
If you have any comments or feedback about this post, you can write to secure@sap.com.
SAP is committed to deliver trustworthy products and cloud services. Secure configuration is essential to ensure secure operation and data integrity. We have therefore documented security recommendations that are consolidated in this document to help you configure the best security for your SAP portfolio.
Reference : SAP Security Patch Day – March 2024
