SAP Security Notes – June 2024

On the 11th of June 2024, SAP Security Patch Day saw the release of 10 new Security Notes.

There were 2 updates to previously released Security Notes.

Notes by severity

Highlights

On June Patch Day SAP presents 2 high-severity Notes, with none of them rated as HotNews.

Despite the fact that the June patch day can delight us with only a few high-priority vulnerabilities, we’ll share with you what you need to pay attention to first in this monthly SAP security Notes update.

Starting today’s digest with SAP Financial Consolidation security patch Note 3457592 – Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation – with a CVSS Score of 8.1.
Two vulnerabilities in SAP Financial Consolidation are addressed in this security note:
Reflected XSS: Data can enter a Web application through an untrusted source thanks to SAP Financial Consolidation. The user can alter the content on the website by accessing these endpoints, which are visible across the network. An attacker has the potential to seriously compromise the application’s integrity and confidentiality if they are successful in their exploit.

Stored XSS: An XSS vulnerability arises from SAP Financial Consolidation‘s inadequate encoding of user-controlled inputs. The network can access these endpoints. Resources outside of the compromised component can be exploited by the vulnerability. An attacker can only slightly compromise the application’s secrecy if they are successful in their exploit.

You can find additional information on Note corrections and prerequisites in CVE-2024-37177 and CVE-2024-37178 guidelines correspondingly.

The next high-severity security Note to highlight will be the Note 3460407 – Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) – with a CVSS Score of 7.5.
Attackers can launch denial-of-service (DoS) attacks against SAP NetWeaver AS Java because of the unfettered access to the Meta Model Repository services, which could bar genuine users from using the program. This may have little effect on integrity and confidentiality but a significant influence on the application’s accessibility.

Another Note to bring forward is medium-severity Note 3453170 – Denial of service (DOS) in SAP NetWeaver and ABAP platform – with a CVSS Score of 6.5.
By overloading or disrupting the service, an attacker might obstruct legitimate users’ ability to access SAP NetWeaver and the ABAP platform.

This Denial of Service vulnerability may result in lengthy response times and service outages, which would negatively affect the quality of service that authorized users receive and have a significant effect on the application’s availability.

SAP Document Builder received a patch today in the face of the Note 3459379 – Unrestricted file upload in SAP Document Builder (HTTP service) – with a CVSS Score of 6.5.
Malicious files can be uploaded to the SAP Document Builder service by an authorized attacker. The attacker is free to view, alter, or prevent the victim’s browser from displaying any associated content when they gain access to this file.

The last Note with 6.5 CVSS Score for today will be 3466175 – Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files).
The application Manage Incoming Payment Files (F1680) of SAP S/4HANA fails to carry out the required authorization checks for a verified user, which leads to privilege escalation. Consequently, it has little effect on the system’s availability or confidentiality and a significant impact on its integrity.

Today’s patch was a good start for SAP’s summer security improvement season. We look forward to informing you of every next significant vulnerability of this summer.

Stay safe!