CVE-2023-37486 Information Disclosure vulnerability in SAP Commerce (OCC API)
An attacker can access restricted information via SAP Commerce OCC API endpoints, resulting in a high impact on confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-37486?
CVE-2023-37486 is a medium-severity vulnerability in SAP_SE SAP Commerce (OCC API), published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.
Weakness: CWE-524
Which versions are affected by CVE-2023-37486?
It affects 2 products.
Products include Sap Commerce Cloud, Sap Commerce Hycom.
How do I fix CVE-2023-37486?
No fix has been published for CVE-2023-37486 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-37486 being exploited?
There is no known exploitation of CVE-2023-37486 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP Commerce (OCC API)
- CVE-2019-0344 SAP Commerce Cloud Deserialization of Untrusted Data
- CVE-2020-6238 XML external entity in SAP Commerce
- CVE-2023-39439 SAP Commerce accepts empty passphrases.
- CVE-2019-0343 Code injection in SAP Commerce Cloud (Mediaconversion Extension)
- CVE-2023-42481 Improper Access Control vulnerability in SAP Commerce Cloud
Sources
Also known as GHSA-m52j-g5rm-pww7.