CVE-2024-47588— Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager)
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-47588
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager)
Source: NVD (National Vulnerability Database)
Vulnerability Description
In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
不充分的凭证保护机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP NetWeaver 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台。该平台主要为SAP应用程序提供开发和运行环境。 SAP NetWeaver 1.1版本存在安全漏洞，该漏洞源于当软件升级遇到错误时，凭据将以纯文本形式写入日志文件，具有服务器本地访问权限的攻击者可以从日志中获取凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Java (Software Update Manager) | SUM 1.1 | - |
II. Public POCs for CVE-2024-47588
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47588
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2024-11-12 · 8 CVEs total
| CVE-2024-47590 | 8.8 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher |
| CVE-2024-42372 | 6.5 MEDIUM | Missing Authorization check in SAP NetWeaver AS Java (System Landscape Directory) |
| CVE-2024-47595 | 6.3 MEDIUM | Local Privilege Escalation in SAP Host Agent |
| CVE-2024-47592 | 5.3 MEDIUM | Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Appli |
| CVE-2024-47586 | 5.3 MEDIUM | NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and AB |
| CVE-2024-47593 | 4.3 MEDIUM | Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP |
| CVE-2024-47587 | 3.5 LOW | Missing authorization check in SAP Cash Management (Cash Operations) |
IV. Related Vulnerabilities
Same vendor: SAP_SE
- CVE-2026-34264
Information Disclosure vulnerability in SAP Human Capital Ma - CVE-2026-34262
Information Disclosure Vulnerability in SAP HANA Cockpit and - CVE-2026-34261
Missing Authorization check in SAP Business Analytics and SA - CVE-2026-34257
Open Redirect vulnerability in SAP NetWeaver Application Ser - CVE-2026-34256
Missing Authorization check in SAP ERP and SAP S/4 HANA (Pri
Same weakness: CWE-522
- CVE-2026-42295
Argo Workflows: Exposure of artifact repository credentials - CVE-2026-41506
go-git Credential leak via cross-host redirect in smart HTTP - CVE-2025-62345
HCL BigFix RunBookAI is affected by a Continued availability - CVE-2026-23927
Agent 2 Oracle plugin TNS connection string injection via th - CVE-2026-42367
GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi privilege
V. Comments for CVE-2024-47588
No comments yet