- Each month, SAP issues critical updates to fortify your systems against potential security threats.
- In October 2024, SAP unveiled 6 new Security Notes and updated 6 previously released notes.
Among the important updates are:
- A medium-priority note addressing an information disclosure vulnerability in SAP NetWeaver AS for Java (CVE-2024-45283, CVSS 6.0).
- A high-priority note correcting a missing authorization check in SAP PDCE (CVE-2024-39592, CVSS 7.7).
By level of severity of the vulnerability, they are classified as:
- One Critical Severity
- Three High Severity
- Eight Medium Severity
In-Depth Analysis: SAP NetWeaver as for Java
In this review, let’s take a closer look at the CVE-2024-45283 vulnerability and analyze it in depth, to understand the potential impact on the SAP environments.
This vulnerability affects the SAP NetWeaver AS for Java (Destination Service), specifically related to the creation of RFC destinations. With a CVSS score of 6.0 out of 10, it’s classified as a medium severity issue.
Key Points:
- An authorized attacker could potentially obtain sensitive information, including usernames and passwords, when creating an RFC destination.
- If exploited, this could lead to unauthorized access to sensitive data, impacting the confidentiality of business information.
- The vulnerability requires local access and high privileges to exploit, which somewhat limits its potential impact.
- No user interaction is needed for the exploit to succeed.
Vulnerability Impact:
- This flaw could allow attackers (that already have a privileged user) to view sensitive credential information, potentially compromising the security of connected SAP systems and external resources.
- While the attacker cannot modify or delete data directly through this vulnerability, the exposed information could be used for further (and more complex) attacks or unauthorized access to other systems.
The Bottom Line
October 2024 SAP Security Patch Day underscores the critical need for specialized SAP security solutions. Organizations must efficiently identify, track, and remediate SAP security vulnerabilities across their entire landscape to minimize exposure to cyber threats.
Vicxer’s expertise in ERP cybersecurity, particularly within SAP environments, uniquely positions us to safeguard business-critical applications from malicious activities. Our advanced SAP Security Platform offers automatic detection and response capabilities, ensuring comprehensive protection against vulnerabilities across their entire SAP landscape.