CVE-2024-33003: 
SAP Commerce Cloud Analyse et atténuation des vulnérabilités

A vulnerability in SAP Commerce Cloud (CVE-2024-33003) was discovered that affects multiple versions including HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205, and COM_CLOUD 2211. The vulnerability allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. The vulnerability was disclosed on August 13, 2024, and received a CVSS v3.1 base score of 7.4 (High) from SAP SE, while NIST assigned it a more severe CVSS score of 9.1 (Critical) (NVD, ASEC).

The vulnerability is classified as an information disclosure issue (CWE-200) that affects OCC API endpoints in SAP Commerce Cloud. The technical nature of the vulnerability involves the exposure of sensitive information to unauthorized actors through URL parameters. The CVSS vector string assigned by NIST is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high impact to both confidentiality and integrity (NVD).

On successful exploitation, this vulnerability could lead to a high impact on the confidentiality and integrity of the application. The exposure of sensitive PII data including passwords, email addresses, mobile numbers, and various codes could potentially be used for unauthorized access, identity theft, or other malicious activities (SecurityWeek).

The vulnerability can be exploited remotely with low attack complexity and requires no special privileges or user interaction. While there are no reported instances of this vulnerability being exploited in the wild, the high CVSS scores from both SAP SE (7.4) and NIST (9.1) indicate that exploitation could have serious consequences (SecurityWeek).

SAP has released patches to address this vulnerability. Users of affected versions are strongly advised to update to the latest version of SAP Commerce Cloud. The fix was included in the September 2024 Security Patch Day updates (ASEC, SecurityWeek).