CVE-2024-47592 Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)
Unauthenticated attackers can brute force login attempts to identify valid user IDs, compromising confidentiality in SAP NetWeaver AS Java.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-47592?
CVE-2024-47592 is a medium-severity vulnerability in SAP_SE SAP NetWeaver Application Server Java (Logon Application), published on 12 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.
Weakness: CWE-307
Which versions are affected by CVE-2024-47592?
How do I fix CVE-2024-47592?
No fix has been published for CVE-2024-47592 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-47592 being exploited?
There is no known exploitation of CVE-2024-47592 in the wild and no public exploit code.
Sources
Also known as GHSA-g2w3-6c6j-74qw.