CVE-2024-47593 — Incorrect Default Permissions in SE SAP Netweaver Application Server Abap

CWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 55.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
SAP SE SAP Netweaver Application Server Abap
Timeline
PublishedNov 12

Description

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTML Technology. This will not compromise the application's integrity or availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-gwgp-7jjg-774v: SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be r↗2024-11-12
▶
CVEList
Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform↗2024-11-12
▶
CVE-2024-47593 — Incorrect Default Permissions | cvebase