SAP Security Notes, July 2024

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.

July 2024 notes

Summary and highlights of the month

The total number of notes/patches has been 18, 5 more than last month. This month, there were no HotNews, just like last month. On the other hand, it is noteworthy that the number of high-criticality notes remains the same as last month: 2 this month. As always, we will leave medium and low notes unreviewed but will provide details of a total of 2 notes (all those with a CVSS of 7 or higher).

We have a total of 18 notes for the whole month (the 18 from Patch Tuesday, 16 new and 2 updates).

We will review in detail a total of 2 notes, the 2 high notes of this month, which are new notes (those with a CVSS greater than or equal to 7).

1. The most critical note of the month (with a CVSS of 7.7) is a new note related to “Missing Authorization check in PDCE.”
2. The next in criticality (CVSS 7.2) is a high note related to “Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce.“
3. The next in criticality (CVSS 6.9) is a medium note related to “Information Disclosure vulnerability in SAP Landscape Management.“
4. The next in criticality (CVSS 6.5 and 6.1) are medium notes related to “Unrestricted file upload in SAP Document Builder (HTTP service),” “Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor,” and “Multiple vulnerabilities in SAP.“
5. This month, the most predominant types are related to “Information Disclosure vulnerability in SAP” (3/18 on Patch Day) and “Missing Authorization check” (3/18 on Patch Day).

In the graph, we can see the classification of the notes for July, in addition to the evolution and classification of the last 5 previous months (only the Sec. Tuesday / Patch Day notes – by SAP):

Full details

The complete detail of the most relevant notes is as follows:

1. Missing Authorization check in PDCE (3483344): PDCE elements do not properly verify authorization for authenticated users, allowing privilege escalation. This allows an attacker to access sensitive information, severely affecting the confidentiality of the application. As a solution, the affected functions have been disabled to restrict access. It is recommended to implement the corresponding support package or follow the remediation instructions in the security note. CVSS v3 Base Score: 7,7 / 10 [CVE-2024-39592]
2.  Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce (3490515): In SAP Commerce, a user can abuse the “forgotten password” functionality to access a Composable Storefront B2B site with early login and registration, without needing approval from the merchant. If the site is not isolated, this can also give access to other non-isolated sites with early login, even if they do not have registration enabled. As a solution, SAP Commerce Cloud addresses this vulnerability by not sending password reset emails if the customer requesting a password reset has not been pre-approved by the merchant. To do so, a series of patches mentioned in the note must be installed. CVSS v3 Base Score 7,2 / 10 [CVE-2024-39597].

Reference links

Other references, from SAP and Onapsis (July):

Digital Library (sap.com)

SAP Patch Day: July 2024 – Onapsis

Resources affected