Advisory
On 13.08.2024 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Commerce Cloud.
SAP Note 3459935 addresses "[CVE-2024-33003] Information Disclosure Vulnerability in SAP Commerce Cloud" to prevent information disclosure with a high risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Information disclosure is when an application fails to properly protect sensitive and confidential information from
parties that are not supposed to have access to the subject matter in normal circumstances.
Carefully review every information disclosure vulnerablity in regards to disclosure obligations post-GDPR for
‘Personal data’ under the Data Protection Act 2018.
Risk specification
This note has been re-released with updated 'Solution' information (SAP Commerce Cloud Update Release 2211.28 instead of SAP Commerce Cloud Update Release 2211.27 contains all fixes). Some OCC API endpoints in SAP Commerce Cloud allows unauthenticated attacker to gain access to Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters, resulting a on confidentiality and integrity of the application.Solution
New variants of the affected OCC API endpoints are provided. These new API endpoints pass confidential data through request body parameters only. SAP Commerce Cloud also deprecates the old, vulnerable OCC API endpoints. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "There are two alternatives to call the old, affected OCC API endpoints: 1. Include query parameters in the request URL, for example: curl --location --request PUT 'https://{server}/occ/v2/{baseSiteId}/users/current/login?newLogin={loginId}&password={password}' 2. Include query parameters in the body with content type application/x-www-form-urlencoded, for example: curl --location --request PUT 'https://{server}/occ/v2/{baseSiteId}/users/current/login' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode newLogin='{loginId}' --data-urlencode password='{password}' To implement this workaround, customers should adjust their client-side code to use the second alternative rather than the first one. The second alternative is not vulnerable, because it does not pass confidential data in the request URL. For the vulnerable OCC API endpoints that include confidential data as URL path parameters, there is no workaround available.".
The advisory is valid for
- COM_CLOUD 2211 9
- HY_COM 1808 15
- HY_COM 1811 16
- HY_COM 1905 26
- HY_COM 2005 22
- HY_COM 2011 16
- HY_COM 2105 15
- HY_COM 2205 14
- 9.9 [CVE-2023-40622] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
- 9.8 [CVE-2023-28765] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
- 9.1 [CVE-2023-28762] Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Console)
- 9.0 [CVE-2020-6252] Information Disclosure in SAP Adaptive Server Enterprise (Cockpit)
- 8.9 Information Disclosure in Central Order
