CVE-2024-33003: Information Disclosure Vulnerability in SAP Commerce Cloud
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33003?
CVE-2024-33003 has been assigned a high severity rating due to the exposure of Personally Identifiable Information.
How do I fix CVE-2024-33003?
To mitigate CVE-2024-33003, ensure that sensitive information is not passed as query or path parameters in API requests.
What systems are affected by CVE-2024-33003?
CVE-2024-33003 affects specific versions of SAP Commerce Cloud, including 1811, 1905, 2005, 2011, 2105, 2205, com_cloud_2211, and hy_com_1808.
What types of data are exposed in CVE-2024-33003?
CVE-2024-33003 potentially exposes passwords, email addresses, mobile numbers, coupon codes, and voucher codes.
Can CVE-2024-33003 lead to data breaches?
Yes, successful exploitation of CVE-2024-33003 can lead to data breaches involving sensitive PII.