CVE-2024-47588

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Nov 12, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-47595.5The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as AuCVE-2024-475908.8An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this CVE-2024-475925.3SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDsCVE-2024-475934.3SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise CVE-2024-475945.4SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability iCVE-2024-475957.1An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploCVE-2024-475967.5GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_CVE-2024-475979.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samCVE-2024-475989.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_meCVE-2024-475997.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-47606.3A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U micCVE-2024-476009.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_chann