Skip to content
OpenAdvisories

Product · SAP

SAP Commerce

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.8
    CVE-2025-24875

    SameSite Defense in Depth not applied for some cookies in SAP Commerce

    SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead t…

    SAP SAP Commerce
  • Medium 5.3
    CVE-2024-41733

    Information Disclosure Vulnerability in SAP Commerce

    In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowled…

    SAP SAP Commerce
  • Medium 6.4
    CVE-2020-6302

    SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application i…

    SAP SAP Commerce
  • Medium 5.3
    CVE-2020-6232

    SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missin…

    SAP SAP Commerce