SAP Security Notes Review: March 2024

Overview

SAP’s security patch day for March 2024 has seen the release of 11 OSS SAP security notes. Two notes have been classified as critical, three as high, and six as medium based on CVSS v3.0 Rating.

Four notes have been released for:

• SAP NetWeaver AS JAVA

Single notes have been released for:

• SAP Build Apps
• SAP ABAP Platform
• SAP Fiori
• SAP Business Objects
• SAP HANA
• SAPGUI for HTML
• SAP Commerce Cloud

Vulnerabilities: March 2024 Highlights

[CVE-2024-22127] Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) (SAP Note 3433192)

The SAP NetWeaver Administrator AS Java Log Viewer plug-in allows an attacker with high privileges to upload potentially dangerous files. This can lead to a command injection vulnerability.

[CVE-2019-10744] Code Injection vulnerability in applications built with SAP Build Apps (SAP Note 3425274)

Applications built with SAP Build Apps are vulnerable to a code injection attack. This vulnerability allows attackers to run unauthorised commands on the system.

[CVE-2023-50164] Path Traversal Vulnerability in SAP BusinessObjects Business Intelligence Platform (Central Management Console) (SAP Note 3414195)

SAP BusinessObjects Business Intelligence Platform CMC uses a version of Apache Struts, which is vulnerable to directory traversal. Accordingly, it could be exploited by a user with high privileges.

[CVE-2023-44487] Denial of service (DOS) in SAP HANA XS Classic and HANA XS Advanced (SAP Note 3410615)

SAP HANA XS Classic and HANA XS Advanced allow an unauthenticated user to perform a DOS attack over the network by making a massive number of HTTP/2 requests and cancelling them later. This action may flood the memory and have a high impact on the application’s availability.