CVE-2019-0344

Due to unsafe deserialization used in SAP Commerce Cloud virtualjdbc extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection...

SAP Commerce Cloud Information Disclosure Vulnerability (CNVD-2025-07505)

SAP Commerce Cloud is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management and operations management. An information disclosure vulnerability exists in SAP Commerce Cloud, which can be exploited by an attacker t...

CVE-2025-26654

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

CVE-2025-26654

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

CVE-2025-27435 Information Disclosure Vulnerability in SAP Commerce Cloud

Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and...

CVE-2025-27435 Information Disclosure Vulnerability in SAP Commerce Cloud

Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and...

CVE-2025-27435

CVE-2025-27435 affects SAP Commerce Cloud. The vulnerability is an information disclosure where a coupon code is exposed in the URL parameters of the Coupon Campaign URL, allowing an unauthenticated attacker to access and use the disclosed code. Impact is described as low for confidentiality and ...

CVE-2025-26654

CVE-2025-26654 refers to SAP Commerce Cloud (Public Cloud) where HTTP traffic on port 80 is redirected to HTTPS (port 443) rather than being fully disabled. The vulnerability arises because the first request may be sent in plaintext before the redirect occurs, potentially compromising confidentia...

CVE-2025-26654 Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

CVE-2025-26654 Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

PT-2025-15365 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud affected versions not specified Description: The issue affects the confidentiality and integrity of data sent in the first request before a redirect from HTTP to HTTPS. Normally, Commerce communicates securely over HTTPS, b...

CVE-2020-26810

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...

CVE-2024-33003

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information PII data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a Hi...

The vulnerability of the Webservice API Endpoint component of the SAP Commerce Cloud platform allows a hacker to disclose protected information.

The vulnerability of the Webservice API Endpoint component of the SAP Commerce Cloud platform is related to the transmission of data in an open manner. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

CVE-2024-47577

Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating ...

CVE-2024-47577

CVE-2024-47577 affects SAP Commerce Cloud’s Webservice API endpoints in the Assisted Service Module. The root cause is that a search request for customer data embeds data in the URL, which is logged server-side, enabling an attacker with admin impersonation to view leaked customer data via logs. ...

CVE-2024-47577 Information Disclosure vulnerability in SAP Commerce Cloud

Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating ...

CVE-2024-47577 Information Disclosure vulnerability in SAP Commerce Cloud

Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating ...

SAP Commerce Cloud 安全漏洞

SAP Commerce Cloud is a cloud-based e-commerce platform from SAP, Germany. It supports sales management, marketing management, order management, and operations management. A security vulnerability exists in SAP Commerce Cloud, which stems from an information disclosure vulnerability in the...

The vulnerability of the SAP Commerce Cloud e-commerce platform, related to insufficient protection of sensitive data, allows attackers to disclose protected information.

The vulnerability of the SAP Commerce Cloud e-commerce platform is related to insufficient protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...