PT-2024-9407 · Sap · Sap Netweaver As Java

Published 2024-12-10 · Updated 2025-04-14 · CVE-2024-47580

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java (affected versions not specified)

Description: The issue allows an attacker authenticated as an administrator to use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability. This can be exploited by a remote attacker to bypass existing security restrictions using specially crafted PDF files.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-538

Related Identifiers

BDU:2024-11100

CVE-2024-47580

Affected Products

Sap Netweaver As Java

References · 11

• https://bdu.fstec.ru/vul/2024-11100 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47580 · Security Note
• https://twitter.com/VulmonFeeds/status/1866343584460337249 · Twitter Post
• https://twitter.com/Djaballah_Med_T/status/1911782828766879982 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2024.html · Note
• https://me.sap.com/notes/3536965 · Note
• https://t.me/cvenotify/103683 · Telegram Post
• https://twitter.com/CVEnew/status/1866432922489675922 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://vulners.com/cve/CVE-2024-47580 · Note
• https://t.me/cvedetector/12469 · Telegram Post