Advisory
On 11.03.2025 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Commerce Cloud.
SAP Note 3566851 addresses "[CVE-2024-38286] Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud" to prevent denial of service (dos) missing authentication check with a high risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specification
This note concerns two CVEs in Apache Tomcat which is a dependency of SAP Commerce Cloud: - SAP Commerce Cloud allows an unauthenticated attacker to cause an OutOfMemoryError by abusing the TLS handshake process (CVE-2024-38286), resulting in Denial of service (DoS). - An exception during the authentication process may not explicitly set an HTTP status to indicate failure, allowing the user to bypass the authentication process (CVE-2024-52316).Solution
Apache Tomcat was upgraded to a non-vulnerable version.
