Medium severity · published Dec 10, 2024
CVE-2024-47580
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
6.8
CVSS
0.5%
EPSS
No
On KEV
Description
An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS for JAVA (Adobe Document Services) · SAP_SE
ADSSSAP 7.50 · source: vendor
Affected product
SN
SAP NetWeaver AS for JAVA (Adobe Document Services)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47580
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47580
me.sap.com
https://me.sap.com/notes/3536965
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver AS for JAVA (Adobe Document Services)
9.1
CVE-2024-47578
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
6.8
CVE-2024-47579
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)