SAP Commerce Cloud Spring Security Misconfiguration Vulnerability Allowing Unauthenticated Code Execution

A vulnerability exists in SAP Commerce Cloud due to improper Spring Security configuration, allowing unauthenticated users to upload malicious configurations and inject code. This misconfiguration leads to arbitrary server-side code execution, significantly impacting the application's confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability allows for arbitrary server-side code execution, with a high impact on the application's confidentiality, integrity, and availability.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform, where users can find the complete list of security notes and prioritize their implementation.