CVE-2018-2463

Severity: high (CVSS 8.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-11 · updated 2026-06-17
Weakness: CWE-918

Description

The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC.

Affected products

SAP SE SAP Commerce (ex. SAP Hybris Commerce): from 6.0 through 6.7

References

http://www.securityfocus.com/bid/105339
https://launchpad.support.sap.com/#/notes/2680834
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
http://www.securityfocus.com/bid/105339
https://launchpad.support.sap.com/#/notes/2680834
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993

Get alerted when CVE-2018-2463 or the next vulnerability affects your stack