{"id":"CVE-2024-33003","state":"PUBLISHED","title":"Information Disclosure Vulnerability in SAP Commerce Cloud","description":"Some OCC API endpoints in SAP Commerce Cloud\nallows Personally Identifiable Information (PII) data, such as passwords, email\naddresses, mobile numbers, coupon codes, and voucher codes, to be included in\nthe request URL as query or path parameters. On successful exploitation, this\ncould lead to a High impact on confidentiality and integrity of the\napplication.","publishedAt":"2024-08-13T03:36:55.034Z","updatedAt":"2024-08-13T14:57:53.908Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"sap"},"assigner":"sap","products":["SAP_SE SAP Commerce Cloud"],"affected":[{"vendor":"SAP_SE","product":"SAP Commerce Cloud","defaultStatus":"unaffected","versions":[{"version":"HY_COM 1808","status":"affected"},{"version":"1811","status":"affected"},{"version":"1905","status":"affected"},{"version":"2005","status":"affected"},{"version":"2105","status":"affected"},{"version":"2011","status":"affected"},{"version":"2205","status":"affected"},{"version":"COM_CLOUD 2211","status":"affected"}]}],"references":["https://me.sap.com/notes/3459935","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/33xxx/CVE-2024-33003.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-33003","state":"PUBLISHED","datePublished":"2024-08-13T03:36:55.034Z","dateUpdated":"2024-08-13T14:57:53.908Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2024-04-23T04:04:25.521Z"},"containers":{"cna":{"title":"Information Disclosure Vulnerability in SAP Commerce Cloud","descriptions":[{"lang":"en","value":"Some OCC API endpoints in SAP Commerce Cloud\nallows Personally Identifiable Information (PII) data, such as passwords, email\naddresses, mobile numbers, coupon codes, and voucher codes, to be included in\nthe request URL as query or path parameters. On successful exploitation, this\ncould lead to a High impact on confidentiality and integrity of the\napplication."}],"affected":[{"vendor":"SAP_SE","product":"SAP Commerce Cloud","defaultStatus":"unaffected","versions":[{"version":"HY_COM 1808","status":"affected"},{"version":"1811","status":"affected"},{"version":"1905","status":"affected"},{"version":"2005","status":"affected"},{"version":"2105","status":"affected"},{"version":"2011","status":"affected"},{"version":"2205","status":"affected"},{"version":"COM_CLOUD 2211","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3459935"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2024-08-13T03:36:55.034Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"sap","product":"commerce_cloud","defaultStatus":"unknown","versions":[{"version":"1808","status":"affected"},{"version":"1811","status":"affected"},{"version":"1905","status":"affected"},{"version":"2005","status":"affected"},{"version":"2011","status":"affected"},{"version":"2105","status":"affected"},{"version":"2205","status":"affected"},{"version":"2211","status":"affected"}],"cpes":["cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*","cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*","cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*","cpe:2.3:a:sap:commerce_cloud:2005:*:*:*:*:*:*:*","cpe:2.3:a:sap:commerce_cloud:2011:*:*:*:*:*:*:*","cpe:2.3:a:sap:commerce_cloud:2105:*:*:*:*:*:*:*","cpe:2.3:a:sap:commerce_cloud:2205:*:*:*:*:*:*:*","cpe:2.3:a:sap:commerce_cloud:2211:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-13T14:46:12.515862Z","id":"CVE-2024-33003","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-13T14:57:53.908Z"}}]}}}