SAP Commerce Coupon Code Exposure Vulnerability

A vulnerability exists in SAP Commerce that allows an unauthenticated attacker to access customer coupon codes through the URL parameters of the Coupon Campaign URL. This exposure could enable the attacker to misuse the disclosed coupon codes, resulting in a low impact on the application's confidentiality and integrity.

Impact

Exploitation of this vulnerability could lead to unauthorized access to coupon codes, allowing for their misuse in the application.

Remediation

Users are advised to review and implement the SAP Security Notes available in SAP for Me. These notes contain important security patches and guidance. For details on the SAP Security Patch Day schedule and how to access SAP Security Notes, refer to the SAP Security Notes FAQ.