[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7xoUbikG2BArzy5qLCpkP8SJ6z7CSSIzqvMg4z72fPk":3,"g5a-family:sap\u002Fcommerce_cloud":164,"g5a-ex:sap\u002Fcommerce_cloud@*":167},{"success":4,"data":5},true,{"product":6,"versions":57,"topVulnerabilitiesByEpss":75,"kevVulnerabilities":136,"seoMetadata":142,"meta":161},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":56},"sap","commerce_cloud",17,16,1,"2024-08-13",[14,18,21,24,26,29,32,34,36,38,40,43,45,48,50,52,54],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},"100",0,false,{"version":19,"cve_count":20,"kev_count":11,"has_kev":4},"1808",10,{"version":22,"cve_count":23,"kev_count":11,"has_kev":4},"1811",12,{"version":25,"cve_count":20,"kev_count":11,"has_kev":4},"1905",{"version":27,"cve_count":28,"kev_count":16,"has_kev":17},"2005",5,{"version":30,"cve_count":31,"kev_count":16,"has_kev":17},"2011",2,{"version":33,"cve_count":11,"kev_count":16,"has_kev":17},"2105",{"version":35,"cve_count":11,"kev_count":16,"has_kev":17},"2205",{"version":37,"cve_count":31,"kev_count":16,"has_kev":17},"2211",{"version":39,"cve_count":11,"kev_count":16,"has_kev":17},"6.3",{"version":41,"cve_count":42,"kev_count":11,"has_kev":4},"6.4",3,{"version":44,"cve_count":42,"kev_count":11,"has_kev":4},"6.5",{"version":46,"cve_count":47,"kev_count":11,"has_kev":4},"6.6",6,{"version":49,"cve_count":47,"kev_count":11,"has_kev":4},"6.7",{"version":51,"cve_count":11,"kev_count":16,"has_kev":17},"8.1",{"version":53,"cve_count":11,"kev_count":16,"has_kev":17},"com_cloud_2211",{"version":55,"cve_count":11,"kev_count":16,"has_kev":17},"hy_com_1808","Commerce Cloud by Sap is a technology product with 17 tracked versions and 16 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":11,"has_kev":4},{"version":22,"cve_count":23,"kev_count":11,"has_kev":4},{"version":25,"cve_count":20,"kev_count":11,"has_kev":4},{"version":27,"cve_count":28,"kev_count":16,"has_kev":17},{"version":30,"cve_count":31,"kev_count":16,"has_kev":17},{"version":33,"cve_count":11,"kev_count":16,"has_kev":17},{"version":35,"cve_count":11,"kev_count":16,"has_kev":17},{"version":37,"cve_count":31,"kev_count":16,"has_kev":17},{"version":39,"cve_count":11,"kev_count":16,"has_kev":17},{"version":41,"cve_count":42,"kev_count":11,"has_kev":4},{"version":44,"cve_count":42,"kev_count":11,"has_kev":4},{"version":46,"cve_count":47,"kev_count":11,"has_kev":4},{"version":49,"cve_count":47,"kev_count":11,"has_kev":4},{"version":51,"cve_count":11,"kev_count":16,"has_kev":17},{"version":53,"cve_count":11,"kev_count":16,"has_kev":17},{"version":55,"cve_count":11,"kev_count":16,"has_kev":17},[76,84,92,99,104,110,114,120,125,131],{"cveId":77,"description":78,"publishedDate":79,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":4,"epssScore":83},"CVE-2019-0344","Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.","2019-08-14",9.8,"v3.1","Critical",0.07079,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":88,"cvssVersion":89,"severity":90,"isKev":17,"epssScore":91},"CVE-2019-0322","SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.","2019-07-10",7.5,"v3.0","High",0.02555,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"cvssVersion":81,"severity":97,"isKev":17,"epssScore":98},"CVE-2020-26809","SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '\u002Fmedias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.","2020-11-10",5.3,"Medium",0.0207,{"cveId":100,"description":101,"publishedDate":79,"cvssScore":102,"cvssVersion":89,"severity":90,"isKev":17,"epssScore":103},"CVE-2019-0343","SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice\u002FHMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.",8.8,0.01482,{"cveId":105,"description":106,"publishedDate":107,"cvssScore":108,"cvssVersion":81,"severity":82,"isKev":17,"epssScore":109},"CVE-2020-6238","SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.","2020-04-14",9.3,0.0131,{"cveId":111,"description":112,"publishedDate":107,"cvssScore":96,"cvssVersion":81,"severity":97,"isKev":17,"epssScore":113},"CVE-2020-6232","SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects confidentiality of secure media.",0.00832,{"cveId":115,"description":116,"publishedDate":117,"cvssScore":118,"cvssVersion":81,"severity":97,"isKev":17,"epssScore":119},"CVE-2020-6201","The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping\u002Fsanitization, leading to Reflected Cross Site Scripting.","2020-03-10",6.1,0.008,{"cveId":121,"description":122,"publishedDate":123,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":17,"epssScore":124},"CVE-2023-39439","SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.","2023-08-08",0.00713,{"cveId":126,"description":127,"publishedDate":128,"cvssScore":129,"cvssVersion":81,"severity":97,"isKev":17,"epssScore":130},"CVE-2021-21445","SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking.","2021-01-12",5.4,0.00643,{"cveId":132,"description":133,"publishedDate":134,"cvssScore":118,"cvssVersion":81,"severity":97,"isKev":17,"epssScore":135},"CVE-2021-33666","When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation.","2021-06-09",0.00543,[137],{"cveId":77,"description":78,"publishedDate":79,"cvssScore":80,"severity":82,"isKev":4,"epssScore":83,"cisaVulnName":138,"cisaDateAdded":139,"cisaShortDescription":140,"cisaRequiredAction":141},"SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability","2024-09-30","SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"title":143,"metaDescription":144,"keywords":145,"structuredData":146},"Commerce Cloud by Sap - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Commerce Cloud by Sap covering 17 versions with 16 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Commerce Cloud vulnerabilities, Commerce Cloud security, Commerce Cloud CVE, Sap Commerce Cloud, Commerce Cloud threat intelligence, Sap security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Commerce Cloud KEV, Commerce Cloud exploited vulnerabilities",{"@context":147,"@type":148,"name":149,"description":144,"url":150,"manufacturer":151,"applicationCategory":155,"softwareVersion":156,"mainEntity":157},"https:\u002F\u002Fschema.org","SoftwareApplication","Commerce Cloud","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fsap\u002Fcommerce_cloud",{"@type":152,"name":153,"url":154},"Organization","Sap","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsap","Security Software","17 versions tracked",{"@type":158,"name":159,"description":160,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Commerce Cloud Security Vulnerabilities","Security vulnerabilities affecting Commerce Cloud by Sap",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":162,"apiVersion":163},"2026-10-18T16:11:22.406Z","3.0",[165],{"product":166,"cves":31},"commerce_cloud_\\(accelerator_payment_mock\\)",{"rows":168,"total":11,"capped":17,"failed":16},[169],{"cveId":77,"name":138,"severity":82,"cvss":80,"added":139,"epss":83,"published":170,"ranges":171,"checked":4,"hits":172,"covers":17},"2019-08-14T14:15:16.463",[41,44,46,49,19,22,25],[]]