CVE-2023-42481

🗓️ 12 Dec 2023 01:00:19Reported by sapType

In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2023-42481 Improper Access Control vulnerability in SAP Commerce Cloud	12 Dec 202301:00	–	cvelist
EUVD	EUVD-2023-46921	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in SAP	13 Dec 202300:00	–	ncsc
NVD	CVE-2023-42481	12 Dec 202301:15	–	nvd
Prion	Default credentials	12 Dec 202301:15	–	prion
Positive Technologies	PT-2023-28366 · Sap · Sap Commerce Cloud	11 Dec 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-42481	23 May 202501:59	–	redhatcve

NVD

Vulners

Node

sap commerce_cloudMatch8.1

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Commerce Cloud",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "HY_COM 1905"
      },
      {
        "status": "affected",
        "version": "HY_COM 2005"
      },
      {
        "status": "affected",
        "version": "HY_COM2105"
      },
      {
        "status": "affected",
        "version": "HY_COM 2011"
      },
      {
        "status": "affected",
        "version": "HY_COM 2205"
      },
      {
        "status": "affected",
        "version": "COM_CLOUD 2211"
      }
    ]
  }
]

Source	Link
sap	www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
me	www.me.sap.com/notes/3394567

21 Nov 2024 08:22Current

8.1High risk

Vulners AI Score8.1

CVSS 3.18.1

EPSS0.00075

CWE-640