CVE-2024-47579

CVSS 3.1: 6.8 medium
EPSS: <1%p44
Published: Dec 10, 2024 · Dec 10, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-47579 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability

Weakness: CWE-538

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news

1 story

SAP fixed critical SSRF flaw in NetWeaver

Security AffairsDec 10, 15:35 UTC · Dec 10, 2024VulnerabilityCVE-2024-47578 CVE-2024-47579 CVE-2024-47580+22 · 1 read