{"id":10992,"date":"2024-04-17T10:29:25","date_gmt":"2024-04-17T08:29:25","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=10992"},"modified":"2024-05-16T13:10:23","modified_gmt":"2024-05-16T11:10:23","slug":"sap-security-notes-april-2024","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/","title":{"rendered":"SAP Security Notes, April 2024"},"content":{"rendered":"

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.<\/strong><\/p>\n\n

April 2024 notes<\/h2>\n

Summary and highlights of the month<\/h3>\n

The total number of notes\/patches this month was 12, the same as last month. There were no Hot News this month, unlike the 3 from last month. Additionally, it\u2019s important to note that the number of critical notes has also remained the same as last month: 3 this month. As usual, we will leave the medium and low severity notes unchecked, but we will provide details of a total of 3 notes<\/strong> (all those with a CVSS of 7 or higher).<\/p>\n

We have a total of 12 notes<\/strong> for the entire month (the 12 from Patch Tuesday, 10 new and 2 updates).<\/p>\n

We will review in detail a total of 3 notes, all 3 corresponding to the high severity notes: the 3 are new (those with a CVSS score of 7 or higher).<\/p>\n

    \n
  1. The most critical note of the month (with a CVSS of 8.8<\/span>)<\/strong> is a new note related to “Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine.”<\/li>\n
  2. The next in terms of severity (CVSS 7.7<\/span>) <\/strong>is another high note related to \u201cInformation Disclosure vulnerability in SAP BusinessObjects Web Intelligence.<\/strong>\u201d<\/li>\n
  3. The following in severity (with a CVSS 7.2<\/span><\/strong>), is another high note related to \u201cDirectory Traversal vulnerability in SAP Asset Accounting.<\/strong>\u201d<\/li>\n
  4. This month, the most predominant type is related to \u201cMissing Authorization check in SAP S\/4 HANA<\/strong>\u201d (2\/12 on patch day).<\/li>\n<\/ol>\n

    In the graph, we can see the classification of the April notes<\/strong><\/span>, as well as the evolution and classification of the last 5 months (only the notes from Sec. Tuesday \/ Patch Day \u2013 by SAP).<\/p>\n

    \"\"<\/p>\n

    Full details<\/h3>\n

    The complete detail of the most relevant notes<\/strong> is as follows:<\/p>\n

      \n
    1. Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine (3434839)<\/u><\/strong>:<\/strong>\u00a0The ‘Self-Registration’ and ‘Modify your own profile’ feature in the NetWeaver AS Java User Admin application lacks the necessary security requirements, which could allow an attacker to compromise data confidentiality. It is recommended that you upgrade your NW Java application server to a version or Service Pack (SP) that has addressed this specific issue. CVSS v3 Base Score: <\/strong>8,8<\/strong><\/span>\u00a0<\/span>\/ 10 [CVE-2024-27899].<\/strong><\/li>\n
    2. \u00a0Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence Product (3421384<\/u><\/strong>): Due to improper validation, SAP Business Object Business Intelligence Launch Pad has a vulnerability that allows an authenticated attacker to access operating system information through a manipulated document. This could compromise the confidentiality of the application. As an interim measure, SAP recommends removing the Excel data access service from all adaptive processing servers to mitigate this risk. CVSS v3 Base Score: <\/strong>7,7<\/strong><\/span>\/ 10 [CVE-2024-25646].<\/strong><\/li>\n
    3. Directory Traversal vulnerability in SAP Asset Accounting\u00a0(3438234<\/u><\/strong>)<\/strong>: SAP Asset Accounting has a vulnerability that could allow an attacker with elevated privileges to exploit insufficient validation of routing information provided by users, affecting the confidentiality, integrity and availability of the application. As a workaround, SAP recommends assigning an authorization group to the RAALTE00 and RAALTD01 programs, ensuring that they can only be executed by users with special privileges.CVSS v3 Base Score: <\/strong>7,2<\/strong><\/span>\u00a0<\/span>\/ 10 [CVE-2024-27901].<\/strong><\/li>\n<\/ol>\n

      Reference links<\/strong><\/h3>\n

      Other references, from SAP and Onapsis (April):<\/p>\n

      Digital Library (sap.com)<\/a><\/p>\n

      SAP Patch Day: April 2024 – Onapsis<\/a><\/p>\n

       <\/p>\n

      Resources affected<\/u><\/strong><\/p>\n

      \n
        \n
      • SAP NetWeaver AS Java User Management Engine, Versions –\u00a0SERVERCORE 7.50, J2EE-APPS 7.50, UMEADMIN 7.50<\/li>\n
      • SAP BusinessObjects Web Intelligence, Versions –\u00a04.2, 4.3<\/li>\n
      • SAP Asset Accounting, Versions – SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_FIN617, SAP_FIN 618, SAP_FIN700<\/li>\n
      • SAP Edge Integration Cell, Versions older than 8.13.5<\/li>\n
      • SAP NetWeaver AS ABAP and ABAP Platform, Versions –\u00a0KRNL64NUC 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.93<\/li>\n
      • SAP Group Reporting Data Collection (Enter Package Data), Versions –\u00a0S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, SAP_GRDC_CLOUD 1.0.0<\/li>\n
      • SAP Employee Self Service (Fiori My Leave Request), Version \u2013 605<\/li>\n
      • SAP S\/4HANA (Manage Catalog Items and Cross-Catalog search), Versions \u2013 S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106<\/li>\n
      • SAP NetWeaver, Version –\u00a07.50<\/li>\n
      • SAP Business Connector, Version – 4.8<\/li>\n
      • SAP S\/4 HANA (Cash Management), Versions \u2013 S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108<\/li>\n
      • SAP S\/4 HANA (Cash Management), Versions \u2013 S4CORE 106, S4CORE 107, S4CORE 108<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

        Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems. April 2024 notes Summary and highlights of the month The total number of notes\/patches this month was 12, the same as last month. There were no Hot News this month, unlike the 3…<\/p>\n","protected":false},"author":6,"featured_media":10995,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[95,61],"tags":[150],"class_list":["post-10992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap-notes","category-sap-security-en-2","tag-sap-notes"],"acf":[],"yoast_head":"\nSAP Security Notes, April 2024 - Inprosec<\/title>\n<meta name=\"description\" content=\"All updates to SAP systems notes from April 2024, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SAP Security Notes, April 2024\" \/>\n<meta property=\"og:description\" content=\"All updates to SAP systems notes from April 2024, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2024-04-17T08:29:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-05-16T11:10:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/04\/notas-sap-abril-2024.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"SAP Security Notes, April 2024\",\"datePublished\":\"2024-04-17T08:29:25+00:00\",\"dateModified\":\"2024-05-16T11:10:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/\"},\"wordCount\":697,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/notas-sap-abril-2024.jpg\",\"keywords\":[\"SAP Notes\"],\"articleSection\":[\"SAP Notes\",\"SAP Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/\",\"name\":\"SAP Security Notes, April 2024 - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/notas-sap-abril-2024.jpg\",\"datePublished\":\"2024-04-17T08:29:25+00:00\",\"dateModified\":\"2024-05-16T11:10:23+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"All updates to SAP systems notes from April 2024, to stay current and improve the security levels of your SAP systems.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/notas-sap-abril-2024.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/notas-sap-abril-2024.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2024\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SAP Security Notes, April 2024\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SAP Security Notes, April 2024 - Inprosec","description":"All updates to SAP systems notes from April 2024, to stay current and improve the security levels of your SAP systems.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/","og_locale":"en_US","og_type":"article","og_title":"SAP Security Notes, April 2024","og_description":"All updates to SAP systems notes from April 2024, to stay current and improve the security levels of your SAP systems.","og_url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/","og_site_name":"Inprosec","article_published_time":"2024-04-17T08:29:25+00:00","article_modified_time":"2024-05-16T11:10:23+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/04\/notas-sap-abril-2024.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"SAP Security Notes, April 2024","datePublished":"2024-04-17T08:29:25+00:00","dateModified":"2024-05-16T11:10:23+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/"},"wordCount":697,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/04\/notas-sap-abril-2024.jpg","keywords":["SAP Notes"],"articleSection":["SAP Notes","SAP Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/","url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/","name":"SAP Security Notes, April 2024 - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/04\/notas-sap-abril-2024.jpg","datePublished":"2024-04-17T08:29:25+00:00","dateModified":"2024-05-16T11:10:23+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"All updates to SAP systems notes from April 2024, to stay current and improve the security levels of your SAP systems.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/04\/notas-sap-abril-2024.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/04\/notas-sap-abril-2024.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2024\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"SAP Security Notes, April 2024"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/10992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=10992"}],"version-history":[{"count":1,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/10992\/revisions"}],"predecessor-version":[{"id":10997,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/10992\/revisions\/10997"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/10995"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=10992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=10992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=10992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}