CVE-2024-33003

9.1 criticalEPSS 0.5%

Critical (9.1) in sap commerce cloud. EPSS 0.5% chance of exploitation in the next 30 days.

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2024-08-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sap:commerce_cloud

References

https://me.sap.com/notes/3459935
https://url.sap/sapsecuritypatchday

Check your stack JSON