Medium severity · published Nov 12, 2024
CVE-2024-47592
Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server Java (Logon Application) · SAP_SE
SERVERCORE 7.5 · source: vendor
NA
Netweaver Application Server Java · Sap
7.5 · source: CISA
Affected product
SN
SAP NetWeaver Application Server Java (Logon Application)
SAP_SE