What’s Vulnerable › Vulnerabilities

CVE-2024-47577: Information Disclosure vulnerability in SAP Commerce Cloud

• Severity: low (CVSS 2.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-10 · updated 2026-06-17
• Weakness: CWE-319

Description

Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating as authorized admin visits such server logs, then they get access to the customer data. The amount of leaked confidential data however is extremely limited, and the attacker has no control over what data is leaked.

Affected products

• SAP_SE SAP Commerce Cloud: HY_COM 2205, COM_CLOUD 2211

References

• https://me.sap.com/notes/3535451
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2024-47577 or the next vulnerability affects your stack