CVEvulnerability

CVE-2024-33003

9.1 CRITICAL Published 2024-08-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-200

Description

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

Affected configurations

• sap commerce cloud 1811 • sap commerce cloud 1905 • sap commerce cloud 2005 • sap commerce cloud 2011 • sap commerce cloud 2105 • sap commerce cloud 2205 • sap commerce cloud com cloud 2211 • sap commerce cloud hy com 1808

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References