CVE-2024-47580
Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
- State
- Published
- Severity
- 6.8 Medium
- Published
- Dec 10, 2024
- Updated
- Dec 16, 2024
- Reserved
- Sep 27, 2024
Description
An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | sap |
Weaknesses
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected Products
| Product | Versions |
|---|---|
SAP NetWeaver AS for JAVA (Adobe Document Services)SAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.