CVE-2024-47580CWE-538

Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)

Medium · published December 10, 2024

CVSS v3.1
6.8
EPSS
1%
Percentile
42.9
In the wild
Unconfirmed
What it is

An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00513 · 42.9th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2024-12-10T00:12Z
EPSS history
Timeline
  • 10 DEC 00:12Z
    Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
    cvelistv5