PT-2024-9334 · Sap · Sap Commerce Cloud

Published 2024-12-10 · Updated 2024-12-10 · CVE-2024-47577

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud (affected versions not specified)

Description: The issue is related to an information disclosure vulnerability in the Webservice API endpoints for the Assisted Service Module within SAP Commerce Cloud. When an authorized agent searches for a customer to manage their accounts, the request URL includes customer data, which is recorded in server logs. If an attacker, impersonating an authorized admin, visits such server logs, they can access the customer data. However, the amount of leaked confidential data is extremely limited, and the attacker has no control over what data is leaked.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2024-11024

CVE-2024-47577

Affected Products

Sap Commerce Cloud

References · 10

• https://bdu.fstec.ru/vul/2024-11024 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47577 · Security Note
• https://twitter.com/VulmonFeeds/status/1866346144491602292 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2024.html · Note
• https://t.me/cvenotify/103680 · Telegram Post
• https://me.sap.com/notes/3535451 · Note
• https://t.me/cvedetector/12471 · Telegram Post
• https://twitter.com/CVEnew/status/1866432925866086704 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://vuldb.com/?id.287490 · Note