Medium severity · published Dec 10, 2024
CVE-2024-47579
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
6.8
CVSS
0.5%
EPSS
No
On KEV
Description
An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS for JAVA (Adobe Document Services) · SAP_SE
ADSSSAP 7.50 · source: vendor
Affected product
SN
SAP NetWeaver AS for JAVA (Adobe Document Services)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47579
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47579
me.sap.com
https://me.sap.com/notes/3536965
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver AS for JAVA (Adobe Document Services)
9.1
CVE-2024-47578
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
6.8
CVE-2024-47580
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)