CVE-2023-37486
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Under certain conditions, SAP Commerce API (OCC) in versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211 allows an attacker to access information that would otherwise be restricted. Successful exploitation could lead to a high impact on confidentiality.
Risk Assessment
The organization may be exposed to the disclosure of sensitive information, potentially leading to breaches of privacy and customer trust.
Recommendation
It is recommended to update to the latest version of SAP Commerce and implement appropriate security measures to restrict access to restricted information.
Original NVD description (English source)
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.