CVE-2024-33003— Information Disclosure Vulnerability in SAP Commerce Cloud
Quick assessment
Affected
SAP_SE SAP Commerce Cloud
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Commerce Cloud是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce Cloud 存在信息泄露漏洞，该漏洞源于某些 OCC API 端点允许将个人身份信息 (PII) 数据作为查询或路径参数包含在请求 URL 中。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-33003
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure Vulnerability in SAP Commerce Cloud
Source: CVE Program / CVE List V5
Vulnerability Description
Some OCC API endpoints in SAP Commerce Cloud
allows Personally Identifiable Information (PII) data, such as passwords, email
addresses, mobile numbers, coupon codes, and voucher codes, to be included in
the request URL as query or path parameters. On successful exploitation, this
could lead to a High impact on confidentiality and integrity of the
application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Commerce Cloud 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Commerce Cloud是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce Cloud 存在信息泄露漏洞，该漏洞源于某些 OCC API 端点允许将个人身份信息 (PII) 数据作为查询或路径参数包含在请求 URL 中。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Commerce Cloud | HY_COM 1808 | - |
|
II. Public POCs for CVE-2024-33003
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-33003
请登录查看更多情报信息。
Other References for CVE-2024-33003 (1)
Same Patch Batch · SAP_SE · 2024-08-13 · 17 CVEs total
| CVE-2024-41730 | 9.8 CRITICAL | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform |
| CVE-2024-42374 | 8.2 HIGH | XML injection in SAP BEx Web Java Runtime Export Web Service |
| CVE-2024-42376 | 6.5 MEDIUM | Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework |
| CVE-2024-33005 | 6.3 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Di |
| CVE-2024-41735 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice |
| CVE-2024-41733 | 5.3 MEDIUM | Information Disclosure Vulnerability in SAP Commerce |
| CVE-2024-41737 | 5.0 MEDIUM | Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management) |
| CVE-2024-41732 | 4.7 MEDIUM | Improper Access Control in SAP Netweaver Application Server ABAP |
| CVE-2024-42377 | 4.3 MEDIUM | Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework |
| CVE-2024-42375 | 4.3 MEDIUM | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intellig |
| CVE-2024-41736 | 4.3 MEDIUM | Information Disclosure vulnerability in SAP Permit to Work |
| CVE-2024-41734 | 4.3 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2024-42373 | 4.3 MEDIUM | Missing Authorization Check in SAP Student Life Cycle Management (SLcM) |
| CVE-2024-39591 | 4.3 MEDIUM | Missing Authorization check in SAP Document Builder |
| CVE-2024-28166 | 3.7 LOW | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intellig |
| CVE-2024-41731 | 3.1 LOW | Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intellig |
IV. Related Vulnerabilities
Same product: SAP Commerce Cloud
-
CVE-2026-44761
Insecure Sample Credentials in SAP Commerce Cloud -
CVE-2026-24321
Information Disclosure vulnerability in SAP Commerce Cloud -
CVE-2026-23684
Race condition vulnerability in SAP Commerce Cloud -
CVE-2025-42906
Directory Traversal vulnerability in SAP Commerce Cloud -
CVE-2025-27435
Information Disclosure Vulnerability in SAP Commerce Cloud
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-200
-
CVE-2026-104455
YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplu -
CVE-2026-103763
SiYuan before v3.8.5 Information Disclosure via /api/noteboo -
CVE-2026-102002
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitiv -
CVE-2026-64892
Johnson Controls Easy IO Neo 3.3b63前敏感信息泄露 -
CVE-2026-67172
HCL BigFix Service Management is affected by multiple securi
V. Comments for CVE-2024-33003
No comments yet