CVE-2024-33003: Information Disclosure Vulnerability in SAP Commerce Cloud
First published: Tue Aug 13 2024(Updated: )
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Commerce Cloud | =1811 | |
| SAP Commerce Cloud | =1905 | |
| SAP Commerce Cloud | =2005 | |
| SAP Commerce Cloud | =2011 | |
| SAP Commerce Cloud | =2105 | |
| SAP Commerce Cloud | =2205 | |
| SAP Commerce Cloud | =com_cloud_2211 | |
| SAP Commerce Cloud | =hy_com_1808 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-33003?
CVE-2024-33003 has been assigned a high severity rating due to the exposure of Personally Identifiable Information.
How do I fix CVE-2024-33003?
To mitigate CVE-2024-33003, ensure that sensitive information is not passed as query or path parameters in API requests.
What systems are affected by CVE-2024-33003?
CVE-2024-33003 affects specific versions of SAP Commerce Cloud, including 1811, 1905, 2005, 2011, 2105, 2205, com_cloud_2211, and hy_com_1808.
What types of data are exposed in CVE-2024-33003?
CVE-2024-33003 potentially exposes passwords, email addresses, mobile numbers, coupon codes, and voucher codes.
Can CVE-2024-33003 lead to data breaches?
Yes, successful exploitation of CVE-2024-33003 can lead to data breaches involving sensitive PII.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/references
- collector/the-register
- source/The Register
- alias/CVE-2024-43491
- alias/CVE-2024-38216
- alias/CVE-2024-38220
- alias/CVE-2024-38194
- alias/CVE-2024-38188
- alias/CVE-2024-43470
- alias/CVE-2024-43469
- alias/CVE-2024-38018
- alias/CVE-2024-43464
- alias/CVE-2024-38119
- alias/CVE-2024-24968
- alias/CVE-2024-23984
- alias/CVE-2024-41730
- alias/CVE-2024-33003
- alias/CVE-2024-7889
- alias/CVE-2024-7890
- alias/CVE-2024-8190
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/sap
- canonical/sap commerce cloud
- version/sap commerce cloud/1811
- version/sap commerce cloud/1905
- version/sap commerce cloud/2005
- version/sap commerce cloud/2011
- version/sap commerce cloud/2105
- version/sap commerce cloud/2205
- version/sap commerce cloud/com_cloud_2211
- version/sap commerce cloud/hy_com_1808