Riskcovery

CVE-2023-42481

Improper Access Control vulnerability in SAP Commerce Cloud

State
Published
Severity
8.1 High
Published
Dec 12, 2023
Updated
Sep 28, 2024
Reserved
Sep 11, 2023

Read the record on cve.org

Description

In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsap

Weaknesses

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Affected Products

ProductVersions
SAP Commerce CloudSAP_SE
  • HY_COM 1905Affected
  • HY_COM 2005Affected
  • HY_COM2105Affected
  • HY_COM 2011Affected
  • HY_COM 2205Affected
  • COM_CLOUD 2211Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.