SAP Security Notes – September 2024

On the 10th of September 2024, SAP Security Patch Day saw the release of 16 new Security Notes.

There were 3 updates to previously released Security Notes.

Notes by severity

Highlights

On September Patch Day SAP presents 2 high-severity Notes, with none of them rated as HotNews.

In fact, September Patch Day is the most interesting for maintaining security of SAP Business Objects due to HotNews critical note. But in our digest for today we will cover medium severity Notes as well.

Starting the digest from mentioned high-severity Note 3479478 re-release – Missing Authentication check in SAP BusinessObjects Business Intelligence Platform – with a CVSS Score of 9.8.
If Enterprise authentication is set for Single Signed On in SAP BusinessObjects Business Intelligence Platform, an unauthorized user can obtain a logon token via a REST endpoint. The system can be completely compromised by the attacker, which would have a high impact on availability, confidentiality, and integrity.
This note has been re-released with updated ‘validity’ and  additional ‘Workaround’ information in the ‘Solution’ section.

The next high-severity note to describe is 3459935 – Information Disclosure Vulnerability in SAP Commerce Cloud – with a CVSS Score of 7.4.
Passwords, email addresses, phone numbers, coupon codes, and voucher codes are examples of Personally Identifiable Information (PII) that can be supplied in the request URL as query or path parameters for some OCC API endpoints in SAP Commerce Cloud. This could have a high impact on the application’s integrity and secrecy if it is successfully exploited.
This note also has been re-released with updated ‘Solution’ information. Current SAP Commerce Cloud Update Release 2211.28 is latest and will contain all fixes.

Next will come the description of several medium-severity Notes for multiple SAP products and application servers.

The third re-released Note 3495876 in order covers multiple vulnerabilities – Multiple vulnerabilities in SAP Replication Server (FOSS) – with a decent CVSS Score of 6.5.
OpenSSL and Spring Framework, two Free Open Source Software (FOSS) libraries that SAP Replication Server supplied, have been found to have numerous vulnerabilities (CVE-2023-0215, CVE-2022-0778, and CVE-2023-0286). Since SAP Replication Server does not use the FOSS’s susceptible capabilities, it is unaffected by the vulnerabilities. Nevertheless, the installation environment could become susceptible due to these weak FOSS.

The Note 3488341 – Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface) – with CVSS Score of 6.5 – can cause a substantial impact on system integrity and availability.
A function module in the antiquated Tobin interface in SAP Production and Revenue Accounting permits unauthorized access that could result in the revelation of extremely sensitive data since there are insufficient authorization checks performed when calling users.

The last Note to highlight will be the S/4HANA security Patch Note 3497347 – Cross-Site Scripting (XSS) in eProcurement on S/4HANA – with a CVSS Score of 6.1.
eProcurement on SAP S/4HANA permits malicious scripts to be executed in the application due to inadequate encoding of user-controlled inputs, which may result in a Reflected Cross-Site Scripting (XSS) vulnerability. The application’s availability is unaffected by this, although its integrity and secrecy may be slightly impacted.

We will stay in touch to inform you on the latest and most significant security that SAP will feature this fall.
Stay safe!