CVE-2024-33003 — Information Disclosure Vulnerability in SAP Commerce Cloud

CVE-2024-33003

Information Disclosure Vulnerability in SAP Commerce Cloud PUBLISHED

Description (CNA)

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Commerce Cloud	affected HY_COM 1808; affected 1811; affected 1905; affected 2005; affected 2105; affected 2011; affected 2205; affected COM_CLOUD 2211

CWE

CWE-200

References

https://me.sap.com/notes/3459935
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.