CVE-2025-26654
Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)
SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request before the redirect may be impacted if the client is configured to use HTTP and sends confidential data on the first request before the redirect.
Reserved 2025-02-12 | Published 2025-04-08 | Updated 2025-04-09 | Assigner sapCWE-319: Cleartext Transmission of Sensitive Information
Support options
