Sap Commerce
Approved changes feed: RSS · Atom
cpe:2.3:a:sap_se:sap_commerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sap Se (f8f3f5db-c060-5230-a8bd-f91674203607) |
|---|---|
| Product | Sap Commerce (de0601e8-51c1-5f6d-8f47-a72d8106ba21) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-24875 |
vulnerable | 2026-06-08 07:12:50.119247 |
SameSite Defense in Depth not applied for some cookies in SAP Commerce
MEDIUM (6.8)
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.
Published: 2025-02-11T00:37:32.280Z
Updated: 2025-02-18T18:05:00.986Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41733 |
vulnerable | 2026-06-08 06:43:55.055738 |
Information Disclosure Vulnerability in SAP Commerce
MEDIUM (5.3)
In SAP Commerce, valid user accounts can be
identified during the customer registration and login processes. This allows a
potential attacker to learn if a given e-mail is used for an account, but does
not grant access to any customer data beyond this knowledge. The attacker must
already know the e-mail that they wish to test for. The impact on
confidentiality therefore is low and no impact to integrity or availability
Published: 2024-08-13T03:52:25.523Z
Updated: 2024-08-13T14:48:19.091Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39597 |
vulnerable | 2026-06-08 06:41:51.176316 |
[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce
HIGH (7.2)
In SAP Commerce, a user can misuse the forgotten
password functionality to gain access to a Composable Storefront B2B site for
which early login and registration is activated, without requiring the merchant
to approve the account beforehand. If the site is not configured as isolated
site, this can also grant access to other non-isolated early login sites, even
if registration is not enabled for those other sites.
Published: 2024-07-09T03:48:11.488Z
Updated: 2024-08-02T04:26:15.985Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39439 |
vulnerable | 2026-06-08 06:09:37.460139 |
SAP Commerce accepts empty passphrases.
HIGH (8.8)
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
Published: 2023-08-08T00:49:01.594Z
Updated: 2025-02-27T21:10:56.748Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41204 |
vulnerable | 2026-06-08 05:48:29.984464 |
Details available
An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.
Published: 2022-10-11T00:00:00.000Z
Updated: 2025-05-20T15:07:49.563Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-42064 |
vulnerable | 2026-06-08 05:35:21.732616 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-40502 |
vulnerable | 2026-06-08 05:35:18.596608 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27602 |
vulnerable | 2026-06-08 05:31:21.850302 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21477 |
vulnerable | 2026-06-08 05:29:12.100316 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6302 |
vulnerable | 2026-06-08 05:26:45.048483 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6265 |
vulnerable | 2026-06-08 05:26:44.950699 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6264 |
vulnerable | 2026-06-08 05:26:44.945959 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6238 |
vulnerable | 2026-06-08 05:26:44.865007 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6232 |
vulnerable | 2026-06-08 05:26:44.851178 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.