PT-2025-15365 · Sap · Sap Commerce Cloud

Published 2025-04-08 · Updated 2025-04-09 · CVE-2025-26654

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud (affected versions not specified)

Description: The issue affects the confidentiality and integrity of data sent in the first request before a redirect from HTTP to HTTPS. Normally, Commerce communicates securely over HTTPS, but if a client is configured to use HTTP and sends confidential data before the redirect, this data may be impacted.

Recommendations: For SAP Commerce Cloud, consider configuring clients to use HTTPS directly to avoid sending confidential data over unencrypted HTTP. As a temporary workaround, restrict the use of HTTP protocol to minimize the risk of exploitation. Avoid sending confidential data in the first request before the redirect to HTTPS.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2025-04846

CVE-2025-26654

Affected Products

Sap Commerce Cloud

References · 8

• https://bdu.fstec.ru/vul/2025-04846 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-26654 · Security Note
• https://t.me/cvedetector/22432 · Telegram Post
• https://t.me/cvetracker/21087 · Telegram Post
• https://twitter.com/CVEnew/status/1909528299967226081 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3543274 · Note
• https://twitter.com/cybercronai/status/1909871593725059252 · Twitter Post