CVE-2024-47580

6.8 mediumEPSS 0.5%

Medium (6.8). EPSS 0.5% chance of exploitation in the next 30 days.

An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-538
Published: 2024-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/3536965
https://url.sap/sapsecuritypatchday

Check your stack JSON