CVE-2024-47579
An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability
- Score
- CVSS 3.1 6.8 Medium
- Status
- Deferred - cna@sap.com
- Published
- 2024-12-10
- Last modified
- 2024-12-16
- Weaknesses
- CWE-538
Affected products
References
- https://me.sap.com/notes/3536965
- https://url.sap/sapsecuritypatchday
