Skip to content
SecondTuesday

SAP Commerce Cloud

18 notes since January 2023.

Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).

Patch DayNoteTitlePriority (derived from CVSS, not SAP’s priority)CVSS
October 20263800517SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) High8.8
August 20263771065Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) Critical10.0
July 20263753495Insecure Sample Credentials in SAP Commerce Cloud Critical9.1
February 20263689543Race condition vulnerability in SAP Commerce Cloud Medium5.9
February 20263687771Information Disclosure vulnerability in SAP Commerce Cloud Medium5.3
October 20253634724Directory Traversal vulnerability in SAP Commerce Cloud Medium5.3
April 20253543274Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud) Medium6.8
April 20253539465Information Disclosure Vulnerability in SAP Commerce Cloud Medium4.2
March 20253569602Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI) High8.8
February 20253555364SameSite Defense in Depth not applied for some cookies in SAP Commerce Medium6.8
February 20253559510Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice Medium6.8
December 20243535451Information Disclosure vulnerability in SAP Commerce Cloud Low2.7
August 20243459935Information Disclosure Vulnerability in SAP Commerce Cloud High7.4
August 20243471450Information Disclosure Vulnerability in SAP Commerce Medium5.3
July 20243490515Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce High7.2
December 20233394567Improper Access Control vulnerability in SAP Commerce Cloud High8.1
August 20233346500SAP Commerce accepts empty passphrases. High8.8
August 20233341934Information Disclosure vulnerability in SAP Commerce (OCC API) Medium5.9