CVE-2026-24321

MEDIUM

5.3

Beschreibung

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

CVE Details

CVSS v3.1 Bewertung5.3

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht2/10/2026

Zuletzt geandert2/17/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

sap:commerce_cloud

Schwachen (CWE)

CWE-359

Referenzen

https://me.sap.com/notes/3687771(cna@sap.com)

https://url.sap/sapsecuritypatchday(cna@sap.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.