PT-2024-8860 · Sap · Sap Netweaver As Java

Published 2024-11-11 · Updated 2024-11-12 · CVE-2024-47588

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Java (Software Update Manager 1.1)

Description: The issue is related to insufficient protection of registration data. Under certain conditions, when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs, leading to a high impact on confidentiality.

Recommendations: For SAP NetWeaver Java (Software Update Manager 1.1), consider restricting access to log files to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit local access to the server and ensure that non-administrative users do not have access to sensitive areas where credentials might be logged. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2024-10526

CVE-2024-47588

Affected Products

Sap Netweaver As Java

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-47588 · Security Note
• https://bdu.fstec.ru/vul/2024-10526 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-47588 · Security Note
• https://redrays.io/blog/sap-security-patch-day-november-2024 · Note
• https://t.me/cvedetector/10562 · Telegram Post
• https://t.me/cvenotify/101325 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html · Note
• https://me.sap.com/notes/3522953 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1856160659156689353 · Twitter Post