Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
The error results from incomplete input data sanitization (CWE-459 — Incomplete Cleanup) combined with faulty Spring Security configuration that does not properly block user-supplied data before processing. An unauthenticated attacker can supply specially crafted input data that is executed as code on the server side. The attack vector is network-based, requires no high privileges or complex conditions — only user interaction (UI:R) is required, which suggests the possibility of an attack, for example, via a crafted link.
Successful exploitation of the vulnerability gives the attacker full control over the application — ability to read and modify data (high impact on confidentiality and integrity) and disrupt its operation (high impact on availability). Due to the scope of impact extending beyond the component (S:C), the consequences may affect the broader infrastructure hosting SAP Commerce Cloud.
Apply patches available from the vendor in accordance with the references — SAP Note 3733064 (https://me.sap.com/notes/3733064) and SAP Security Patch Day guidelines (https://url.sap/sapsecuritypatchday). It is recommended to verify Spring Security configuration in the production environment and monitor unauthorized requests to the application.
SAP Commerce Cloud — specific versions indicated in the vendor references (SAP Note 3733064 and SAP Security Patch Day)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H