Advisory
A note with CVSS 9.6 for component CEC-SCC-PLA-PL was released by SAP on 09.12.2025. The correction/advisory 3683579 was described with "Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud" and affects the system type SAP Commerce Cloud.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is command injectionpath traversal within SAP Commerce Cloud.
Risk specification
This note addresses two vulnerabilities in Apache Tomcat within SAP Commerce Cloud: - SAP Commerce Cloud allows an unauthenticated attacker to use a specially crafted URL to inject ANSI escape sequences, resulting in manipulation of the console and potentially tricking an administrator into executing an attacker-controlled command. - SAP Commerce Cloud allows an unauthenticated attacker to manipulate the request URI to bypass security constraints, which may result in unauthorized access to files or the upload of malicious files.
Solution
SAP Commerce Cloud addresses these potential vulnerabilities by upgrading Apache Tomcat to versions that are not affected by these CVEs. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "Ensure that you don't access the logs with a console that understands ANSI escape sequences (such as the Windows console).RewriteValve is not enabled by default in the SAP CX Commerce/Cloud Public Cloud base setup. If RewriteValve has been enabled through customization, please ensure it is disabled as a workaround.".
