- 303/2024
- High
SAP has released security updates to address several vulnerabilities affecting multiple SAP products.
SAP has released a patch that fixes several vulnerabilities affecting multiple SAP products such as SAP NetWeaver, SAP Web Dispatcher, SAP PDCE, SAP Host Agent, SAP Cash Management, and SAP Bank Account Management.
The attacker could exploit some of these vulnerabilities to bypass security restrictions, obtain sensitive information, gain elevated privileges, perform denial of service attacks, or execute arbitrary code and gain access to the affected systems.
Sample of the addressed vulnerabilities:
1. SAP Web Dispatcher Cross-Site Scripting Vulnerability (CVE-2024-47590):
- CVSS: 8.8
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Consequences: Gain Access
2. SAP PDCE Missing Authorization Check Vulnerability (CVE-2024-39592):
- CVSS: 7.7
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Consequences: Gain Privileges
Vulnerabilities
- CVE-2024-47590
- CVE-2024-39592
- CVE-2024-42372
- CVE-2024-47595
- CVE-2024-47592
- CVE-2024-47586
- CVE-2024-47588
- CVE-2024-47593
- CVE-2024-47587
- CVE-2024-33000
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.