HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2024-33003

CVSS 7.4v3.1pub. 2024-08-13upd. 2024-09-16

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Sap Commerce Cloud

    APP
    Sap
    181119052005201121052205com_cloud_2211hy_com_1808
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2019-0344CRITICAL9.8⚠ KEVten sam produkt

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7,...

CVE-2020-6238CRITICAL9.3ten sam produkt

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from ...

CVE-2023-42481HIGH8.1ten sam produkt

In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 221...

CVE-2023-39439HIGH8.8ten sam produkt

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to...

CVE-2019-0343HIGH8.8ten sam produkt

SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authe...