PT-2024-6829 · Sap · Sap Commerce Cloud

Published 2024-08-12 · Updated 2024-09-12 · CVE-2024-41733

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud (affected versions not specified)

Description The issue is related to insufficient protection of service data in SAP Commerce Cloud, allowing a remote attacker to potentially disclose protected information. In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality is low, and there is no impact to integrity or availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-08049

CVE-2024-41733

Affected Products

Sap Commerce Cloud

References · 10

• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41733 · Security Note
• https://bdu.fstec.ru/vul/2024-08049 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41733 · Vendor Advisory
• https://t.me/cvedetector/2955 · Telegram Post
• https://me.sap.com/notes/3471450 · Note
• https://twitter.com/CVEnew/status/1823212338519921143 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2024.html · Note
• https://t.me/cvenotify/94334 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823214185880183093 · Twitter Post