CVE-2024-41733: Information Disclosure Vulnerability in SAP Commerce
In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality therefore is low and no impact to integrity or availability
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41733?
CVE-2024-41733 has a low severity level as it does not permit unauthorized access to customer data.
How do I fix CVE-2024-41733?
To fix CVE-2024-41733, ensure you are using the latest version of SAP Commerce, specifically updates that address this vulnerability.
What systems are affected by CVE-2024-41733?
CVE-2024-41733 affects SAP Commerce versions com_cloud_2211 and hy_com_2205.
What type of information can be leaked due to CVE-2024-41733?
CVE-2024-41733 allows potential attackers to verify if a specific email is associated with an existing user account.
Is user data exposed in CVE-2024-41733?
No, CVE-2024-41733 does not expose any actual user data beyond the confirmation of an email address being tied to an account.