SAP Security Notes – May 2024

On the 14th of May 2024, SAP Security Patch Day saw the release of 14 new Security Notes.

There were 3 updates to previously released Security Notes.

Notes by severity

Highlights

On May Patch Day SAP presents 4 high-severity Notes, with 3 of them rated as HotNews.

May Patch Day brought us several high priority NetWeaver AS ABAP security updates along with various additional improvements. We will break down essential ones below for you today.

Let us start today’s digest with the usual highly-prioritized 3rd party Google Chromium browser update with the Note 2622660 – Security updates for the browser control Google Chromium delivered with SAP Business Client – with a CVSS Score of 10.0.
This note has been re-released with updated ‘Solution’ and ‘Support Packages & Patches’ information.

The next in order will be Note 3455438 – Multiple vulnerabilities in SAP CX Commerce – with the CVSS Score of 9.8.
The Note contains a number of corrections dedicated to CSS Injection and Remote Code Execution vulnerabilities correspondingly.
The Swagger UI used by SAP CX Commerce is susceptible to CVE-2019-17495 (CSS injection). This vulnerability puts the application’s confidentiality, integrity, and availability at serious risk by allowing attackers to use the Relative Path Overwrite (RPO) approach in CSS-based input fields. This correction obtains a 9.8 CVSS Score.
SAP CX Commerce with Apache Calcite Avatica 1.18.0 is susceptible to CVE-2022-36364 (Remote code execution) as a result of incorrect initialization. HTTP client instances are created by the Apache Calcite Avatica JDBC driver using the class names that are supplied through the `httpclient_impl} connection attribute. Nevertheless, the driver doesn’t check to see if the class implements the anticipated interface before instantiating it, which may result in remote code execution or code execution loaded via arbitrary classes in unusual circumstances.

This correction obtains a 8.8 CVSS Score.

Further we have a couple on Notes dedicated to SAP NetWeaver AS ABAP security:
The HotNews Note 3448171 – File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform – with a CVSS Score of 9.6.
When a victim accesses a malicious file uploaded by an unauthorized attacker, the attacker can gain total control over the system. More sufficient information for the Note could be found in bonded CVE-2024-33006.

And the Note 3448445 – Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform – with a CVSS Score of 6.5.
An XSS vulnerability arises from SAP NetWeaver Application Server for ABAP and ABAP Platform‘s insufficient encoding of user-controlled inputs. An attacker has the ability to manipulate code that runs in a user’s browser. This can lead to data modification or deletion, including access to or deletion of files, or the theft of session cookies, which an attacker could then use to take control of a user’s session. Thus, this might affect the system’s availability, integrity, and confidentiality.

The next high severity 3431794 Note brings the correction for SAP BusinessObjects Business Intelligence Platform – Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform – with the CVSS Score of 8.1.
An attacker may be able to alter a parameter in the Opendocument URL on the SAP Business Objects Business Intelligence Platform through stored XSS vulnerability, which might have a significant impact on the application’s confidentiality and integrity.

And the last one for the breakdown will be 3441944 Note, interesting to highlight – Missing authorization check in SAP Enable Now Manager – with the CVSS Score of 6.5.
As a result of SAP Enable Now Manager failing to carry out the required authorization checks for an authenticated user, privileges can escalate. The confidentiality of the application will be greatly impacted if the attacker using the role of “Learner” is able to successfully exploit other users’ data in the manager.

That is all for today about the most important May SAP security updates.

Stay safe!