Vulnerabilitycritical
SAP fixed critical SSRF flaw in NetWeaver
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-47578 | Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application | 9.1 | <1% | ||
| CVE-2024-47579 | An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server | 6.8 | <1% | ||
| CVE-2024-47580 | An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment | 6.8 | <1% | ||
| CVE-2024-47590 | An unauthenticated attacker can create a malicious link which they can make publicly available | 8.8 | <1% | ||
| CVE-2024-54198 | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted… | 8.5 | <1% |
From the original article
1 min read at securityaffairs.com
SAP has issued patches for 16 vulnerabilities, including a critical SSRF flaw in NetWeaver’s Adobe Document Services. SAP addressed 16 vulnerabilities as part of its December 2024 Security Patch Day . The company released nine new and four updated security notes.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.