This month, we see a larger number of released notes than in previous months: 19 new notes in total and only 2 updates to existing notes. See below for the highlights and the end of this post for a complete overview. 

High priority 

No security notes this time with priority ‘HotNews’, so we start with some of the notes with ‘High’ Priority.

A year ago (Patch Tuesday 2024), SAP released note 3417627 that addressed a so-called ‘Cross Site Scripting vulnerability’ in the user admin application of SAP AS Java. The update to note 3417627 now declares that the solution is not sufficient, and note 3557138 is required to implement, which is also part of this month’s release. 

Note 3525794 describes how an attacker can use a secret passphrase to impersonate any user on the SAP BusinessObjects BI platform. Apart from applying the patches, see note 3559381 for a secure implementation of the new Trusted Authentication method combined with CORBA SSL.

Note 3567974 shortly names a vulnerability in the so-called ‘SAP Approuter’, which is fixed in a new version. The ‘SAP Approuter’ is not a traditional SAP component and is likely not well-known by those responsible for patch management, like technical consultants. The SAP Approuter is a node.js module that can be deployed in Cloud Foundry environments on BTP. As the name says, it is used to ‘route’ traffic for deployed applications, think of it as a kind of ‘reverse proxy’ component. This is a fix that probably requires the involvement of development teams to confirm its usage and the implementation of the fix.

See the following links for background on this component:

• https://help.sap.com/docs/btp/sap-business-technology-platform/application-router?locale=en-US
• https://community.sap.com/t5/technology-blogs-by-sap/sap-application-router/ba-p/13393550

The next note 3567172 , also concerns a less traditional component: SAP Enterprise Project Connection. It runs on SAP AS Java, and the patch includes an updated SCA file with the fixed open-source libraries. Although this product is going towards end-of-maintenance, that does not mean it is not relevant for security! 

Medium priority

Note 3559510 describes a patch for the protection against clickjacking and the different patches when using either SAP Commerce Cloud or the on-premise variant.

Note 3540273 is only relevant when using certain versions of Apache Solr and other prerequisites. Apart from applying the patches, note the general recommendation to run a hardened standalone Solr server on a separate machine!

The remaining notes mainly concern notes that ‘simply’ requires patching to mitigate the risks of the identified vulnerabilities. Every note deserves a careful analysis, though for implementation. For a complete list, see below.