Lucene search

SapCVE-2023-39439

HistoryAug 08, 2023 - 1:15 a.m.

CVE-2023-39439

2023-08-0801:15:19

CWE-258

sap

web.nvd.nist.gov

sap commerce cloud

cve-2023-39439

user authentication

security vulnerability

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

Affected configurations

Nvd

Node

sapcommerce_cloudMatch2211

sapcommerce_hycomMatch2105

sapcommerce_hycomMatch2205

VendorProductVersionCPE
sapcommerce_cloud2211cpe:2.3:a:sap:commerce_cloud:2211:*:*:*:*:*:*:*
sapcommerce_hycom2105cpe:2.3:a:sap:commerce_hycom:2105:*:*:*:*:*:*:*
sapcommerce_hycom2205cpe:2.3:a:sap:commerce_hycom:2205:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	commerce_cloud	2211	cpe:2.3:a:sap:commerce_cloud:2211:::::::*
sap	commerce_hycom	2105	cpe:2.3:a:sap:commerce_hycom:2105:::::::*
sap	commerce_hycom	2205	cpe:2.3:a:sap:commerce_hycom:2205:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Commerce",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "HY_COM 2105"
      },
      {
        "status": "affected",
        "version": "HY_COM 2205"
      },
      {
        "status": "affected",
        "version": "COM_CLOUD 2211"
      }
    ]
  }
]

References

me.sap.com/notes/3346500

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

Related for CVE-2023-39439