SAP Commerce

CVE-2025-27435: SAP Commerce URLs Leak Coupon Codes
CVE-2025-27435 4.2 - Medium - April 08, 2025

Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and integrity of the application.

AuthZ

SAP Commerce Email Enumeration Vulnerability - CVE-2024-41733
CVE-2024-41733 5.3 - Medium - August 13, 2024

In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality therefore is low and no impact to integrity or availability

Information Disclosure

SAP Commerce OCC API Unauthorized Info Disclosure in HY_COM/COM_CLOUD
CVE-2023-37486 7.5 - High - August 08, 2023

Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.

Use of Cache Containing Sensitive Information

SAP Commerce login page URL injection for credential theft (CVE-2022-41204)
CVE-2022-41204 8.8 - High - October 11, 2022

An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.

Open Redirect

If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011
CVE-2021-42064 9.8 - Critical - December 14, 2021

If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.

SQL Injection

SAP Commerce - versions 2105.3
CVE-2021-40502 8.8 - High - November 10, 2021

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.

AuthZ

SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011
CVE-2021-27619 6.5 - Medium - May 11, 2021

SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application
CVE-2021-27602 9.9 - Critical - April 13, 2021

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.

Code Injection

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules
CVE-2021-21477 9.9 - Critical - February 09, 2021

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.

Code Injection