github - ghsa-7m3q-23p4-mw4v

ghsa-7m3q-23p4-mw4v

Vulnerability from github

Published

2024-08-13 06:30

Modified

2024-08-13 06:30

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2024-33003",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-200",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2024-08-13T04:15:07Z",
      severity: "HIGH",
   },
   details: "Some OCC API endpoints in SAP Commerce Cloud\nallows Personally Identifiable Information (PII) data, such as passwords, email\naddresses, mobile numbers, coupon codes, and voucher codes, to be included in\nthe request URL as query or path parameters. On successful exploitation, this\ncould lead to a High impact on confidentiality and integrity of the\napplication.",
   id: "GHSA-7m3q-23p4-mw4v",
   modified: "2024-08-13T06:30:47Z",
   published: "2024-08-13T06:30:47Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-33003",
      },
      {
         type: "WEB",
         url: "https://me.sap.com/notes/3459935",
      },
      {
         type: "WEB",
         url: "https://url.sap/sapsecuritypatchday",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
         type: "CVSS_V3",
      },
   ],
}

cve-2024-33003

Vulnerability from cvelistv5

Published

2024-08-13 03:36

Modified

2024-08-13 14:57

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

▼	URL	Tags
	https://me.sap.com/notes/3459935
	https://url.sap/sapsecuritypatchday

Impacted products

	Vendor	Product	Version
	SAP_SE	SAP Commerce Cloud	Version: HY_COM 1808 Version: 1811 Version: 1905 Version: 2005 Version: 2105 Version: 2011 Version: 2205 Version: COM_CLOUD 2211

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*",
                     "cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*",
                     "cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*",
                     "cpe:2.3:a:sap:commerce_cloud:2005:*:*:*:*:*:*:*",
                     "cpe:2.3:a:sap:commerce_cloud:2011:*:*:*:*:*:*:*",
                     "cpe:2.3:a:sap:commerce_cloud:2105:*:*:*:*:*:*:*",
                     "cpe:2.3:a:sap:commerce_cloud:2205:*:*:*:*:*:*:*",
                     "cpe:2.3:a:sap:commerce_cloud:2211:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "commerce_cloud",
                  vendor: "sap",
                  versions: [
                     {
                        status: "affected",
                        version: "1808",
                     },
                     {
                        status: "affected",
                        version: "1811",
                     },
                     {
                        status: "affected",
                        version: "1905",
                     },
                     {
                        status: "affected",
                        version: "2005",
                     },
                     {
                        status: "affected",
                        version: "2011",
                     },
                     {
                        status: "affected",
                        version: "2105",
                     },
                     {
                        status: "affected",
                        version: "2205",
                     },
                     {
                        status: "affected",
                        version: "2211",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-33003",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-08-13T14:46:12.515862Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-08-13T14:57:53.908Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "SAP Commerce Cloud",
               vendor: "SAP_SE",
               versions: [
                  {
                     status: "affected",
                     version: "HY_COM 1808",
                  },
                  {
                     status: "affected",
                     version: "1811",
                  },
                  {
                     status: "affected",
                     version: "1905",
                  },
                  {
                     status: "affected",
                     version: "2005",
                  },
                  {
                     status: "affected",
                     version: "2105",
                  },
                  {
                     status: "affected",
                     version: "2011",
                  },
                  {
                     status: "affected",
                     version: "2205",
                  },
                  {
                     status: "affected",
                     version: "COM_CLOUD 2211",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Some OCC API endpoints in SAP Commerce Cloud\nallows Personally Identifiable Information (PII) data, such as passwords, email\naddresses, mobile numbers, coupon codes, and voucher codes, to be included in\nthe request URL as query or path parameters. On successful exploitation, this\ncould lead to a High impact on confidentiality and integrity of the\napplication.",
                  },
               ],
               value: "Some OCC API endpoints in SAP Commerce Cloud\nallows Personally Identifiable Information (PII) data, such as passwords, email\naddresses, mobile numbers, coupon codes, and voucher codes, to be included in\nthe request URL as query or path parameters. On successful exploitation, this\ncould lead to a High impact on confidentiality and integrity of the\napplication.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-08-13T03:36:55.034Z",
            orgId: "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            shortName: "sap",
         },
         references: [
            {
               url: "https://me.sap.com/notes/3459935",
            },
            {
               url: "https://url.sap/sapsecuritypatchday",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Information Disclosure Vulnerability in SAP Commerce Cloud",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "e4686d1a-f260-4930-ac4c-2f5c992778dd",
      assignerShortName: "sap",
      cveId: "CVE-2024-33003",
      datePublished: "2024-08-13T03:36:55.034Z",
      dateReserved: "2024-04-23T04:04:25.521Z",
      dateUpdated: "2024-08-13T14:57:53.908Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted