CVE-2024-47588CWE-522

Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager)

Medium · published November 12, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00126 · 2.1th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2024-11-12T00:26Z
EPSS history
Timeline
  • 12 NOV 00:26Z
    Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager)
    cvelistv5