CVE-2024-33003

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-330044.3SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logCVE-2024-330056.3Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP CVE-2024-330069.6An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely coCVE-2024-330073.5PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document conCVE-2024-330084.9SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication CVE-2024-330094.2SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify databaseCVE-2024-33018.5An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to post-authentication remCVE-2024-330107.5Transient DOS while parsing fragments of MBSSID IE from beacon frame.CVE-2024-330117.5Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.CVE-2024-330127.5Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.CVE-2024-330137.5Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.CVE-2024-330147.5Transient DOS while parsing ESP IE from beacon/probe response frame.