GCVE - cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*

part: a version: 6.7 update: *

Vendor	Sap (`dd5aa0c0-20b0-5c86-a937-aa29f1a33b77`)
Product	Commerce Cloud (`dcc962b4-c597-5003-9bf3-300d7e2969e9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-6238`	vulnerable	2026-06-08 05:26:44.865181	Details available CRITICAL (9.3) SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce. Published: 2020-04-14T18:39:02.000Z Updated: 2024-08-04T08:55:22.193Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 https://launchpad.support.sap.com/#/notes/2904480	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-6201`	vulnerable	2026-06-08 05:26:44.709939	Details available MEDIUM (6.1) The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting. Published: 2020-03-10T20:19:04.000Z Updated: 2024-08-04T08:55:22.115Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 https://launchpad.support.sap.com/#/notes/2876813	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-6200`	vulnerable	2026-06-08 05:26:44.707024	Details available MEDIUM (5.4) The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework. Published: 2020-03-10T20:18:50.000Z Updated: 2024-08-04T08:55:21.904Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 https://launchpad.support.sap.com/#/notes/2876413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-0344`	vulnerable	2026-06-08 05:12:19.730905	Details available Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection. Published: 2019-08-14T13:53:21.000Z Updated: 2025-10-21T23:45:32.174Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 https://launchpad.support.sap.com/#/notes/2786035	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-0343`	vulnerable	2026-06-08 05:12:19.728492	Details available SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application. Published: 2019-08-14T13:53:05.000Z Updated: 2024-08-04T17:44:16.564Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 https://launchpad.support.sap.com/#/notes/2786035	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-0322`	vulnerable	2026-06-08 05:12:19.695391	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.