CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-37486 – Information Disclosure vulnerability in SAP Commerce (OCC API)
https://notcve.org/view.php?id=CVE-2023-37486
08 Aug 2023 — Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application. Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restrict... • https://me.sap.com/notes/3341934 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-524: Use of Cache Containing Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-39439 – SAP Commerce accepts empty passphrases.
https://notcve.org/view.php?id=CVE-2023-39439
08 Aug 2023 — SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase. • https://me.sap.com/notes/3346500 • CWE-258: Empty Password in Configuration File CWE-1390: Weak Authentication •
CVSS: 8.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-41266
https://notcve.org/view.php?id=CVE-2022-41266
13 Dec 2022 — Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce. Debido a la falta de una validación de entrada adecuada, SAP Commerce Webservices 2.0 (Swagger UI... • https://launchpad.support.sap.com/#/notes/3248255 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-41204
https://notcve.org/view.php?id=CVE-2022-41204
11 Oct 2022 — An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system. Un atacante puede cambiar el contenido de una página de inicio de sesión de SAP Commerce - versiones 1905, ... • https://launchpad.support.sap.com/#/notes/3239152 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •