Critical severity · published Aug 13, 2024
CVE-2024-33003
Information Disclosure Vulnerability in SAP Commerce Cloud
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
Some OCC API endpoints in SAP Commerce Cloud
allows Personally Identifiable Information (PII) data, such as passwords, email
addresses, mobile numbers, coupon codes, and voucher codes, to be included in
the request URL as query or path parameters. On successful exploitation, this
could lead to a High impact on confidentiality and integrity of the
application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SAP Commerce Cloud · SAP_SE
HY_COM 1808; 1811; 1905; 2005; 2105; 2011; +2 more · source: vendor
CC
Commerce Cloud · Sap
1811; 1905; 2005; 2011; 2105; 2205; +2 more · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-33003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-33003
Permissions Required
https://me.sap.com/notes/3459935
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from SAP Commerce Cloud
9.1
CVE-2026-44761
Insecure Sample Credentials in SAP Commerce Cloud
5.9
CVE-2026-23684
Race condition vulnerability in SAP Commerce Cloud
5.3
CVE-2026-24321
Information Disclosure vulnerability in SAP Commerce Cloud
5.3
CVE-2025-42906
Directory Traversal vulnerability in SAP Commerce Cloud
4.2
CVE-2025-27435
Information Disclosure Vulnerability in SAP Commerce Cloud