CVE-2024-41733 Information Disclosure Vulnerability in SAP Commerce
Attackers can identify valid user accounts via email during registration or login, revealing account existence without accessing other data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41733?
CVE-2024-41733 is a medium-severity vulnerability in SAP_SE SAP Commerce, published on 13 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality therefore is low and no impact to integrity or availability
Weakness: CWE-200
Which versions are affected by CVE-2024-41733?
It affects 1 product.
Products include Sap Commerce.
How do I fix CVE-2024-41733?
No fix has been published for CVE-2024-41733 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41733 being exploited?
There is no known exploitation of CVE-2024-41733 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP Commerce
Sources
Also known as GHSA-4x4m-ghmx-6q9w.