HTTP Redirection Vulnerability in SAP Commerce Cloud by SAP
CVE-2025-26654

6.8MEDIUM

Key Information:

Vendor
SAP
Status
SAP Commerce Cloud (public Cloud)
Vendor
CVE Published:
8 April 2025

Summary

SAP Commerce Cloud's inability to fully disable unencrypted HTTP on port 80 poses a significant risk as it allows HTTP traffic to be redirected to HTTPS. This design flaw can compromise the confidentiality and integrity of data transmitted during the initial client request made over HTTP, prior to the redirect. Clients that inadvertently connect via HTTP may expose sensitive information, creating a potential vulnerability for businesses relying on secure communications.

Affected Version(s)

SAP Commerce Cloud (Public Cloud) COM_CLOUD 2211

References

https://me.sap.com/notes/3543274
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.