SAP Commerce Cloud vulnerabilities
3 known vulnerabilities in SAP Commerce Cloud from SAP. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
SAP Commerce Cloud: Use of Default Credentials
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known creden
- 9.1 Critical severity
SAP Commerce Cloud: Exposure of Sensitive Information to an Unauthorized Actor
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successfu
- 8.1 High severity
SAP Commerce Cloud: Weak Password Recovery Mechanism for Forgotten Password
In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Com