« Volver al listado

CVE-2024-47590

Estado: AplazadaAlta (8.8)—

An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Application Isolation and SandboxingExploit ProtectionUpdate Software

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47590",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47590",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-12T16:07:08.713669Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Web Dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "WEBDISP 7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.77"
            },
            {
              "status": "affected",
              "version": "9.12"
            },
            {
              "status": "affected",
              "version": "9.13"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "web_dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "7.89"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "web_dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "7.93"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "web_dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "kernel_7.77"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:9.12:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "web_dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "9.12"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:9.13:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "web_dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "9.13"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:webdisp_7.77:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "web_dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "webdisp_7.77"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-12T01:15:04.933",
  "references": [
    {
      "url": "https://me.sap.com/notes/3520281",
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-791"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability."
    },
    {
      "lang": "es",
      "value": "Un atacante no autenticado puede crear un enlace malicioso que puede poner a disposición del público. Cuando una víctima autenticada hace clic en este enlace malicioso, la generación de páginas del sitio web utilizará los datos de entrada para crear contenido que, cuando se ejecute en el navegador de la víctima (XXS) o se transmita a otro servidor (SSRF), le dará al atacante la capacidad de ejecutar código arbitrario en el servidor, comprometiendo por completo la confidencialidad, la integridad y la disponibilidad."
    }
  ],
  "lastModified": "2026-06-17T07:57:21.550",
  "sourceIdentifier": "cna@sap.com"
}