Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →On April 9, 2024, SAP published 10 new Security Notes and updates to two previously released notes. Three entries were rated High: issues affecting SAP NetWeaver AS Java User Management Engine, SAP BusinessObjects Web Intelligence, and SAP Asset Accounting. The bulletin is a historical release notice; whether any issue applies to an SAP system today depends on its installed components, versions, support packages, and remediation status.
What SAP released on April 9, 2024
SAP’s April 2024 Security Patch Day bulletin reports 10 new Security Notes and two updates to notes released earlier. It lists affected products and versions, vulnerability descriptions, severity ratings, and CVSS scores where supplied. The three High-severity entries are distinct vulnerabilities; the bulletin also includes medium-severity issues.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
SAP System Security Guide (SAP PRESS) | $67.49 | Buy on Amazon |
| 2 |
|
Mastering SAP: Protecting your SAP environment in Today's Cybersecurity World | $9.99 | Buy on Amazon |
| 3 |
|
SAP Security and Authorizations | $17.57 | Buy on Amazon |
| 4 |
|
Beginner's Guide to SAP Security and Authorizations | $19.95 | Buy on Amazon |
SAP advised customers to prioritize applying patches. The release counts and ratings below describe what SAP published for that Patch Day, not the current status of any particular installation.
The three High-severity entries
| SAP Note and CVE | Issue | Affected product and versions listed | Severity and CVSS |
|---|---|---|---|
| 3434839 / CVE-2024-27899 | Security misconfiguration | SAP NetWeaver AS Java User Management Engine; SERVERCORE 7.50, J2EE-APPS 7.50, and UMEADMIN 7.50 | High; 8.8 |
| 3421384 / CVE-2024-25646 | Information disclosure | SAP BusinessObjects Web Intelligence; versions 4.2 and 4.3 | High; 7.7 |
| 3438234 / CVE-2024-27901 | Directory traversal | SAP Asset Accounting; the bulletin lists SAP_APPL and SAP_FIN versions. Consult the current note for the exact affected component and version scope. | High; 7.2 |
The scores are the CVSS values in SAP’s April 2024 bulletin. A High rating alone does not show that a system is affected or exposed: the deployed product and component versions must match the scope in the applicable Security Note.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
Other issues in the April bulletin
The remaining entries were not additional High-severity vulnerabilities. SAP also listed medium-severity issues, including a stack overflow in SAP Integration Suite Edge Integration Cell for versions older than 8.13.5 and a denial-of-service issue in SAP NetWeaver AS ABAP and ABAP Platform. Other affected products named in the bulletin include SAP Group Reporting Data Collection, Employee Self Service, SAP S/4HANA, SAP NetWeaver, SAP Business Connector, and SAP S/4HANA Cash Management.
For the full set of notes, descriptions, ratings, and affected scopes, use SAP’s 2024 Security Patch Day bulletins and open the linked note for the entry you are assessing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How administrators should assess and remediate
- Identify the exact deployed components. Record the SAP product, component names, versions, and support-package levels in the landscape you are assessing.
- Open the current SAP Security Note. Search SAP for Me by note number or CVE, then verify the note’s current affected scope and correction instructions. Do not infer applicability from a product name or severity label alone.
- Check maintenance and support-package status. SAP says security fixes for NetWeaver-based products are also delivered through support packages. Its handling of high- and very-high-severity fixes depends on support-package age and whether the product release is in Mainstream or Extended Maintenance; some Customer-Specific Maintenance cases have separate handling.
- Apply the correction SAP specifies and validate the result. Use the note’s implementation guidance and the correction tools available through SAP for Me. Follow your organization’s change controls and confirm the target system’s resulting version or correction status.
SAP’s Security Notes & News guidance describes SAP for Me access, tools to identify, select, and implement corrections, and the relationship between fixes and support packages. Check the live note and applicable maintenance policy before scheduling a version-specific change; the April bulletin alone cannot establish whether a system is currently vulnerable, whether exploitation occurred, or whether a correction has already been installed.
Quick Recap
Rank #3
- Used Book in Good Condition
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
