by Kastro
Paper/Archive/CVE-2024-33003

CVE-2024-33003

SAP_SE SAP Commerce Cloud — Information Disclosure Vulnerability in SAP Commerce Cloud

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 41.1.411 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

Affected

ProductAffectedFixed inSource
SAP Commerce CloudHY_COM 1808–CNA
SAP Commerce Cloud1811–CNA
SAP Commerce Cloud1905–CNA
SAP Commerce Cloud2005–CNA
SAP Commerce Cloud2105–CNA
SAP Commerce Cloud2011–CNA
SAP Commerce Cloud2205–CNA
SAP Commerce CloudCOM_CLOUD 2211–CNA
commerce_cloud1808–CISA-ADP
commerce_cloud1811–CISA-ADP
commerce_cloud1905–CISA-ADP
commerce_cloud2005–CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
sap (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3459935refurl.sap/sapsecuritypatchday