by Kastro
Paper/Archive/CVE-2024-47578

CVE-2024-47578

SAP_SE SAP NetWeaver AS for JAVA (Adobe Document Services) — Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.3.593 × 2011.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable.

Affected

ProductAffectedFixed inSource
SAP NetWeaver AS for JAVA (Adobe Document Services)ADSSSAP 7.50–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3536965refurl.sap/sapsecuritypatchday