CVE-2024-33003

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-33003
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://me.sap.com/notes/3459935 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2005:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2011:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2105:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2205:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:com_cloud_2211:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:hy_com_1808:*:*:*:*:*:*:*
History

16 Sep 2024, 16:22

Type Values Removed Values Added
References () https://me.sap.com/notes/3459935 - () https://me.sap.com/notes/3459935 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
CPE cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:com_cloud_2211:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2011:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2105:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2005:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:hy_com_1808:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_cloud:2205:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.4 		v2 : unknown
v3 : 9.1
CWE NVD-CWE-noinfo
First Time Sap
Sap commerce Cloud
Summary
  • (es) Algunos endpoints de la API de OCC en SAP Commerce Cloud permiten que se incluyan datos de información de identificación personal (PII), como contraseñas, direcciones de correo electrónico, números de teléfono móvil, códigos de cupón y códigos de vale, en la URL de solicitud como parámetros de consulta o ruta. Si se explota con éxito, esto podría tener un alto impacto en la confidencialidad y la integridad de la aplicación.

13 Aug 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-13 04:15

Updated : 2024-09-16 16:22

NVD link : CVE-2024-33003

Mitre link : CVE-2024-33003

CVE.ORG link : CVE-2024-33003

JSON object : View

Products Affected

sap

  • commerce_cloud
CWE
NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor