PT-2023-4247 · Sap · Sap Commerce Cloud+1

Published 2023-06-07 · Updated 2024-09-28 · CVE-2023-37486

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud versions HY COM 2105, HY COM 2205, COM CLOUD 2211 SAP Hybris Commerce versions HY COM 2105, HY COM 2205

Description The issue is related to the implementation of the Omni Commerce Connect (OCC) API in SAP Commerce Cloud and SAP Hybris Commerce, which lacks sufficient protection of service data. This can allow a remote attacker to impact the confidentiality of protected information. Under certain conditions, the OCC API endpoints may permit an attacker to access restricted information, potentially resulting in a high impact on confidentiality without affecting the integrity and availability of the application.

Recommendations For versions HY COM 2105, HY COM 2205, and COM CLOUD 2211, consider restricting access to the OCC API endpoints to minimize the risk of exploitation. As a temporary workaround, consider disabling the OCC API until a patch is available. Restrict access to sensitive information to minimize the risk of confidentiality breaches.

Fix

Information Disclosure

Weakness Enumeration

CWE-524

CWE-200

Related Identifiers

BDU:2023-04562

CVE-2023-37486

Affected Products

Sap Commerce Cloud

Sap Hybris Commerce

References · 8

• https://osv.dev/vulnerability/CVE-2023-37486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37486 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04562 · Security Note
• https://t.me/cibsecurity/67939 · Telegram Post
• https://me.sap.com/notes/3341934 · Note
• https://vuldb.com/?id.236318 · Note
• https://blogs.sap.com/2023/08/08/sap-security-patch-day-august-2023 · Note