Description
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SAP_SE SAP Commerce Cloud
Default version status: unaffected
HY_COM 1808affected1811affected1905affected2005affected2105affected2011affected2205affectedCOM_CLOUD 2211affected