Vulnerabilities > CVE-2018-2463 - Server-Side Request Forgery (SSRF) vulnerability in SAP Hybris

047910
CVSS 8.6 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
sap
CWE-918
NVD
Published: 2018-09-11
Updated: 2024-11-21

Summary

The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC.

Vulnerable Configurations

Part Description Count
Application
Sap
8

Common Weakness Enumeration (CWE)

References