SAP Commerce Hycom (HY_COM) 2205
Approved changes feed: RSS · Atom
cpe:2.3:a:sap:commerce_hycom:2205:*:*:*:*:*:*:*
part: a version: 2205 update: *
| Vendor | Sap (dd5aa0c0-20b0-5c86-a937-aa29f1a33b77) |
|---|---|
| Product | Commerce Hycom (0ff286d3-fa27-5b46-ae1d-a91f40b3cd5b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-41733 |
vulnerable | 2026-06-08 06:43:55.054966 |
Information Disclosure Vulnerability in SAP Commerce
MEDIUM (5.3)
In SAP Commerce, valid user accounts can be
identified during the customer registration and login processes. This allows a
potential attacker to learn if a given e-mail is used for an account, but does
not grant access to any customer data beyond this knowledge. The attacker must
already know the e-mail that they wish to test for. The impact on
confidentiality therefore is low and no impact to integrity or availability
Published: 2024-08-13T03:52:25.523Z
Updated: 2024-08-13T14:48:19.091Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39597 |
vulnerable | 2026-06-08 06:41:51.174656 |
[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce
HIGH (7.2)
In SAP Commerce, a user can misuse the forgotten
password functionality to gain access to a Composable Storefront B2B site for
which early login and registration is activated, without requiring the merchant
to approve the account beforehand. If the site is not configured as isolated
site, this can also grant access to other non-isolated early login sites, even
if registration is not enabled for those other sites.
Published: 2024-07-09T03:48:11.488Z
Updated: 2024-08-02T04:26:15.985Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39439 |
vulnerable | 2026-06-08 06:09:37.462640 |
SAP Commerce accepts empty passphrases.
HIGH (8.8)
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
Published: 2023-08-08T00:49:01.594Z
Updated: 2025-02-27T21:10:56.748Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-37486 |
vulnerable | 2026-06-08 06:08:15.493946 |
Information Disclosure vulnerability in SAP Commerce (OCC API)
MEDIUM (5.9)
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.
Published: 2023-08-08T00:56:51.511Z
Updated: 2024-10-08T16:25:34.841Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.