CVE-2024-47578

Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3536965
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Adobe Document Service permite a un atacante con privilegios de administrador enviar una solicitud manipulada desde una aplicación web vulnerable. Por lo general, se utiliza para atacar sistemas internos detrás de firewalls que normalmente son inaccesibles para un atacante desde la red externa, lo que genera una vulnerabilidad de Server-Side Request Forgery. Si se explota con éxito, el atacante puede leer o modificar cualquier archivo o hacer que todo el sistema no esté disponible.

10 Dec 2024, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-10 01:15

Updated : 2026-06-17 07:57

NVD link : CVE-2024-47578

Mitre link : CVE-2024-47578

CVE.ORG link : CVE-2024-47578

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-47578", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47578", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-12-10T15:41:02.864066Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP NetWeaver AS for JAVA (Adobe Document Services)", "versions": [{"status": "affected", "version": "ADSSSAP 7.50"}], "defaultStatus": "unaffected"}]}], "published": "2024-12-10T01:15:05.660", "references": [{"url": "https://me.sap.com/notes/3536965", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable."}, {"lang": "es", "value": "Adobe Document Service permite a un atacante con privilegios de administrador enviar una solicitud manipulada desde una aplicaci\u00f3n web vulnerable. Por lo general, se utiliza para atacar sistemas internos detr\u00e1s de firewalls que normalmente son inaccesibles para un atacante desde la red externa, lo que genera una vulnerabilidad de Server-Side Request Forgery. Si se explota con \u00e9xito, el atacante puede leer o modificar cualquier archivo o hacer que todo el sistema no est\u00e9 disponible."}], "lastModified": "2026-06-17T07:57:20.620", "sourceIdentifier": "cna@sap.com"}