CVE-2023-37486— Information Disclosure vulnerability in SAP Commerce (OCC API)
Quick assessment
Affected
SAP_SE SAP Commerce (OCC API)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Commerce是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce (OCC API) 存在信息泄露漏洞，该漏洞源于在某些条件下，HY_COM 2105、HY_COM 2205、COM_CLOUD 2211 端点可以访问受限制信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-37486
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure vulnerability in SAP Commerce (OCC API)
Source: CVE Program / CVE List V5
Vulnerability Description
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过缓存导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Commerce 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Commerce是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce (OCC API) 存在信息泄露漏洞，该漏洞源于在某些条件下，HY_COM 2105、HY_COM 2205、COM_CLOUD 2211 端点可以访问受限制信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Commerce (OCC API) | HY_COM 2105 | - |
|
II. Public POCs for CVE-2023-37486
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-37486
请登录查看更多情报信息。
Other References for CVE-2023-37486 (2)
Same Patch Batch · SAP_SE · 2023-08-08 · 15 CVEs total
| CVE-2023-37483 | 9.8 CRITICAL | Improper Access Control Vulnerabilities in SAP PowerDesigner |
| CVE-2023-39439 | 8.8 HIGH | SAP Commerce accepts empty passphrases. |
| CVE-2023-36923 | 7.8 HIGH | Code Injection vulnerability in SAP PowerDesigner |
| CVE-2023-39437 | 7.6 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP Business One |
| CVE-2023-37490 | 7.6 HIGH | Binary hijack in SAP BusinessObjects Business Intelligence (Installer) |
| CVE-2023-37491 | 7.5 HIGH | Improper Authorization check vulnerability in SAP Message Server |
| CVE-2023-33993 | 7.1 HIGH | SQL Injection vulnerability in SAP Business One B1i Layer |
| CVE-2023-37488 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration |
| CVE-2023-39436 | 5.8 MEDIUM | Information Disclosure in SAP Supplier Relationship Management |
| CVE-2023-37487 | 5.3 MEDIUM | Security misconfiguration vulnerability in SAP Business One (Service Layer) |
| CVE-2023-37484 | 5.3 MEDIUM | Information Disclosure Vulnerabilities in SAP PowerDesigner |
| CVE-2023-37492 | 4.9 MEDIUM | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform |
| CVE-2023-39440 | 4.4 MEDIUM | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform |
| CVE-2023-36926 | 3.7 LOW | Information disclosure vulnerability in SAP Host Agent |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-524
-
CVE-2026-19202
Token Cache Reuse in mcp-toolbox-sdk-python -
CVE-2026-93748
http-cache-semantics through 4.2.0 Cross-User Cache Disclosu -
CVE-2026-89186
mpp writes Payment-Receipt and Cache-Control before the wrap -
CVE-2026-82755
ash_authentication_oauth2_server serves tenant-specific OAut -
CVE-2026-15743
Catalyst::Plugin::Static::Simple versions through 0.38 for P
V. Comments for CVE-2023-37486
No comments yet