Sap Commerce
Approved changes feed: RSS · Atom
cpe:2.3:a:sap_se:sap_commerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sap Se (f8f3f5db-c060-5230-a8bd-f91674203607) |
|---|---|
| Product | Sap Commerce (de0601e8-51c1-5f6d-8f47-a72d8106ba21) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-24875 |
vulnerable | 2026-06-08 07:12:50.119247 |
SameSite Defense in Depth not applied for some cookies in SAP Commerce
MEDIUM (6.8)
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.
Published: 2025-02-11T00:37:32.280Z
Updated: 2025-02-18T18:05:00.986Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41733 |
vulnerable | 2026-06-08 06:43:55.055738 | db.gcve.eu returned HTTP 503. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39597 |
vulnerable | 2026-06-08 06:41:51.176316 |
[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce
HIGH (7.2)
In SAP Commerce, a user can misuse the forgotten
password functionality to gain access to a Composable Storefront B2B site for
which early login and registration is activated, without requiring the merchant
to approve the account beforehand. If the site is not configured as isolated
site, this can also grant access to other non-isolated early login sites, even
if registration is not enabled for those other sites.
Published: 2024-07-09T03:48:11.488Z
Updated: 2024-08-02T04:26:15.985Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39439 |
vulnerable | 2026-06-08 06:09:37.460139 |
SAP Commerce accepts empty passphrases.
HIGH (8.8)
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
Published: 2023-08-08T00:49:01.594Z
Updated: 2025-02-27T21:10:56.748Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41204 |
vulnerable | 2026-06-08 05:48:29.984464 |
Details available
An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.
Published: 2022-10-11T00:00:00.000Z
Updated: 2025-05-20T15:07:49.563Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-42064 |
vulnerable | 2026-06-08 05:35:21.732616 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-40502 |
vulnerable | 2026-06-08 05:35:18.596608 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27602 |
vulnerable | 2026-06-08 05:31:21.850302 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21477 |
vulnerable | 2026-06-08 05:29:12.100316 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6302 |
vulnerable | 2026-06-08 05:26:45.048483 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6265 |
vulnerable | 2026-06-08 05:26:44.950699 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6264 |
vulnerable | 2026-06-08 05:26:44.945959 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6238 |
vulnerable | 2026-06-08 05:26:44.865007 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6232 |
vulnerable | 2026-06-08 05:26:44.851178 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.