SAP Security Notes – July 2024

On the 9th of June 2024, SAP Security Patch Day saw the release of 16 new Security Notes.

There were 2 updates to previously released Security Notes.

Notes by severity

Highlights

On July Patch Day SAP presents 2 high-severity Notes, with none of them rated as HotNews.

Despite the fact that the June patch day can delight us with only a few high-priority vulnerabilities, we’ll share with you what you need to pay attention to first in this monthly SAP security Notes update.

The July patch day covered a relatively large number of diverse vulnerabilities for multiple components. Although they are mostly of medium severity, we will tell you about the most important improvements over the past month in today’s digest.

We will start the digest for today with the highest rated correction in this month, Note 3483344 – Missing Authorization check in SAP PDCE – with a CVSS Score of 7.7.
Because certain PDCE components don’t carry out the required authorization checks for a verified user, privileges can escalate.

This greatly compromises the application’s security by enabling an attacker to view private data. The corrections and solutions required can be found in the corresponding SAP Note.

The next to highlight will be the high-severity Note 3490515 – Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce – with a CVSS Score of 7.2.
When early login and registration are enabled for a Composable Storefront B2B site in SAP Commerce, users can take advantage of the forgotten password functionality to access the site without the merchant having to approve the account beforehand. Even if registration is not allowed for those other sites, access to other non-isolated early login sites may be permitted if the site is not set up as an isolated site.

That is it for high-severities, however, we would like to describe the most interesting Notes of the medium category.

And the first of them will be a correction for SAP Landscape Management, Note 3466801 – Information Disclosure vulnerability in SAP Landscape Management – with a CVSS Score of 6.9, very close to be rated as the high-severity one.
A verified user can view private information revealed by the REST Provider Definition response using SAP Landscape Management. A successful exploitation could have a significant effect on the controlled companies’ confidentiality.
We advise you to pay close attention to this correction if your landscape is maintained up to date especially.

Second will be the Note 3482217 – Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse – Business Planning and Simulation – with a CVSS Score 6.1.
This Note contains the description for the Reflected XSS and Stored XSS corrections correspondingly for two vulnerabilities in SAP Business Warehouse – Business Planning and Simulation.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the SAP Business Warehouse – Business Planning and Simulation application because user controlled inputs are not appropriately encoded. An attacker can have minimal effect on the application’s confidentiality and integrity following a successful exploitation. You can find more information through the following CVE-2024-39594

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SAP Business Warehouse – Business Planning and Simulation application because user-controlled inputs are not appropriately encoded too. Users can alter the content of websites due to this vulnerability, and if it is successfully exploited, an attacker may have minimal effect on the application’s confidentiality and integrity. The CVE for this will be CVE-2024-39595.

The last correction for today’s digest to talk about will be the Note 3468681 – Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor – with a CVSS Score of 6.1.
SAP NetWeaver Knowledge Management XMLEditor permits malicious scripts to be executed in the program due to inadequate encoding of user-controlled input, which may result in a Cross-Site Scripting (XSS) vulnerability. This has minimal effect on the application’s integrity and secrecy but no effect on the application’s availability.

That will be it! Our team wishes you a fresh gentle breeze for this beautiful summer to rest within.
Stay safe!