CVE-2024-47588

MEDIUM

4.7

Description

In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.

Details CVE

Score CVSS v3.14.7

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueLOCAL

ComplexiteHIGH

Privileges requisLOW

Interaction utilisateurNONE

Publie11/12/2024

Derniere modification11/12/2024

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-522

References

https://me.sap.com/notes/3522953(cna@sap.com)

https://url.sap/sapsecuritypatchday(cna@sap.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.