{"id":11690,"date":"2024-06-12T17:24:29","date_gmt":"2024-06-12T15:24:29","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=11690"},"modified":"2024-06-12T17:24:29","modified_gmt":"2024-06-12T15:24:29","slug":"sap-security-notes-june-2024","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/","title":{"rendered":"SAP Security Notes, June 2024"},"content":{"rendered":"

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.<\/strong><\/p>\n\n

June 2024 notes<\/h2>\n

Summary and highlights of the month<\/h3>\n

The total number of notes\/patches has been 13, 4 less than last month. This month, there have been no HotNews, unlike last month when there were 3. On the other hand, it is worth noting that the number of high-criticality notes has increased compared to last month: 2 this month. As always, we will leave medium and low notes unreviewed, but we will detail a total of 2 notes<\/strong> (all with a CVSS of 7<\/strong><\/span> or higher).<\/p>\n

We have a total of 13 notes<\/strong> for the whole month (all 13 from Patch Tuesday, 10 new and 3 updates).<\/p>\n

We will review in detail a total of 2 notes, the 2 high notes of this month, which are new notes (those with a CVSS of 7<\/strong><\/span> or higher).<\/p>\n

    \n
  1. The most critical note of the month<\/strong> (with a CVSS <\/strong>8.1<\/strong><\/span>) is a new note related to “Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation”.<\/strong><\/li>\n
  2. The next most critical (CVSS <\/strong>7.5<\/strong><\/span>) is a high note related to “Denial of Service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)”.<\/strong><\/li>\n
  3. The following in criticality (CVSS <\/strong>6.5<\/strong><\/span>) are medium notes related to “Denial of Service (DOS) in SAP NetWeaver and ABAP platform”, “Unrestricted file upload in SAP Document Builder (HTTP service)”,<\/strong> and “Missing Authorization check in SAP S\/4HANA (Manage Incoming Payment Files)”.<\/strong><\/li>\n
  4. This month, the most predominant type is related to “Missing Authorization check in SAP”<\/strong> (4\/13 on patch day).<\/li>\n<\/ol>\n

    In the graph, we can see the classification of the June notes<\/u><\/strong>, as well as the evolution and classification of the last 5 months (only the notes from Sec. Tuesday \/ Patch Day \u2013 by SAP):<\/p>\n

    \"\"<\/p>\n

    Full details<\/h3>\n

    The complete detail of the most relevant notes<\/strong> is as follows:<\/p>\n

      \n
    1. \u00a0Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation (3457592)<\/u><\/strong>:<\/strong> This security note addresses two vulnerabilities in SAP Financial Consolidation: Reflected XSS<\/strong>: SAP Financial Consolidation allows data to enter a web application through an untrusted source, which can modify website content and significantly impact the confidentiality and integrity of the application if successfully exploited & Stored XSS<\/strong>: SAP Financial Consolidation does not properly encrypt user input, allowing Cross-Site Scripting (XSS) attacks that can impact application confidentiality. URL parameters are now properly encoded to prevent XSS attacks. It is recommended to implement the support packages and patches mentioned in the SAP Note. CVSS v3 Base Score: <\/strong>8,1<\/strong><\/span>\/ 10 <\/strong>[CVE-2024-37177]<\/strong><\/li>\n
    2. \u00a0Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) (3460407<\/u><\/strong>)<\/strong>: Due to the unrestricted access to the metamodel repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks, preventing access to legitimate users. This severely affects the availability, but not the confidentiality and integrity of the application. The code has been fixed and the application has been configured securely, so it is recommended to implement the support packages and patches mentioned in the SAP Note. CVSS v3 Base Score<\/strong> 7,5<\/strong> <\/span>\/ 10 [CVE-2024-34688].<\/strong><\/li>\n<\/ol>\n

      Reference links<\/strong><\/h3>\n

      Other references, from SAP and Onapsis (June):<\/p>\n

      Digital Library (sap.com)<\/a><\/p>\n

      SAP Patch Day: June 2024 – Onapsis<\/a><\/p>\n

       <\/p>\n

      Resources affected<\/u><\/strong><\/p>\n

      \n
        \n
      • SAP Financial Consolidation, Version – FINANCE 1010<\/li>\n
      • SAP NetWeaver AS Java, Version – MMR_SERVER 7.5<\/li>\n
      • SAP NetWeaver and ABAP platform, Versions – ST-PI 2008_1_700, 2008_1_710, 740<\/li>\n
      • SAP Document Builder, Versions – S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747, 748<\/li>\n
      • SAP S\/4HANA (Manage Incoming Payment Files), Versions \u2013 S4CORE 102, 103, 104, 105, 106, 107, 108<\/li>\n
      • SAP CRM WebClient UI, Versions \u2013 S4FND 102, 103, 104, 105, 106, 107, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800, 801<\/li>\n
      • SAP NetWeaver Application Server ABAP and ABAP Platform, Versions – SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795, SAP_BASIS 796<\/li>\n
      • SAP BW\/4HANA Transformation and Data Transfer Process, Versions \u2013 DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757, 758<\/li>\n
      • SAP Student Life Cycle Management, Versions \u2013 IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807, 808<\/li>\n
      • SAP NetWeaver AS Java, Version \u2013 GP-CORE 7.5<\/li>\n
      • Central Finance Infrastructure Components, Versions – SAP_FIN 720, 730, SAPSCORE 114, S4CORE 100, 101, 102<\/li>\n
      • SAP BusinessObjects Business Intelligence Platform, Versions \u2013 ENTERPRISE 420, 430, 440<\/li>\n
      • SAP Bank Account Management, Versions \u2013 100, 101, 102, 103, 104, 105, 106, 107, 108<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

        Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems. June 2024 notes Summary and highlights of the month The total number of notes\/patches has been 13, 4 less than last month. This month, there have been no HotNews, unlike last month when…<\/p>\n","protected":false},"author":6,"featured_media":11692,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[95,61],"tags":[150],"class_list":["post-11690","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap-notes","category-sap-security-en-2","tag-sap-notes"],"acf":[],"yoast_head":"\nSAP Security Notes, June 2024 - Inprosec<\/title>\n<meta name=\"description\" content=\"All updates to SAP systems notes from June 2024, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SAP Security Notes, June 2024\" \/>\n<meta property=\"og:description\" content=\"All updates to SAP systems notes from June 2024, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2024-06-12T15:24:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/06\/notas-sap-junio-2024.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"SAP Security Notes, June 2024\",\"datePublished\":\"2024-06-12T15:24:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/\"},\"wordCount\":650,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/notas-sap-junio-2024.jpg\",\"keywords\":[\"SAP Notes\"],\"articleSection\":[\"SAP Notes\",\"SAP Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/\",\"name\":\"SAP Security Notes, June 2024 - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/notas-sap-junio-2024.jpg\",\"datePublished\":\"2024-06-12T15:24:29+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"All updates to SAP systems notes from June 2024, to stay current and improve the security levels of your SAP systems.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/notas-sap-junio-2024.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/notas-sap-junio-2024.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2024\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SAP Security Notes, June 2024\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SAP Security Notes, June 2024 - Inprosec","description":"All updates to SAP systems notes from June 2024, to stay current and improve the security levels of your SAP systems.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/","og_locale":"en_US","og_type":"article","og_title":"SAP Security Notes, June 2024","og_description":"All updates to SAP systems notes from June 2024, to stay current and improve the security levels of your SAP systems.","og_url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/","og_site_name":"Inprosec","article_published_time":"2024-06-12T15:24:29+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/06\/notas-sap-junio-2024.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"SAP Security Notes, June 2024","datePublished":"2024-06-12T15:24:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/"},"wordCount":650,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/06\/notas-sap-junio-2024.jpg","keywords":["SAP Notes"],"articleSection":["SAP Notes","SAP Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/","url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/","name":"SAP Security Notes, June 2024 - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/06\/notas-sap-junio-2024.jpg","datePublished":"2024-06-12T15:24:29+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"All updates to SAP systems notes from June 2024, to stay current and improve the security levels of your SAP systems.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/06\/notas-sap-junio-2024.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/06\/notas-sap-junio-2024.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2024\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"SAP Security Notes, June 2024"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/11690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=11690"}],"version-history":[{"count":1,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/11690\/revisions"}],"predecessor-version":[{"id":11694,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/11690\/revisions\/11694"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/11692"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=11690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=11690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=11690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}