PT-2024-28548 · Sap · Sap Commerce

Published 2024-07-08 · Updated 2024-07-10 · CVE-2024-39597

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Commerce (affected versions not specified)

Description A user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as an isolated site, this can also grant access to other non-isolated early login sites, even if registration is not enabled for those other sites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-39597

Affected Products

Sap Commerce

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-39597 · Security Note
• https://twitter.com/VulmonFeeds/status/1810550757113938368 · Twitter Post
• https://t.me/cvedetector/231 · Telegram Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/cracbot/status/1811279362731422018 · Twitter Post
• https://twitter.com/CVEnew/status/1810528575386493329 · Twitter Post
• https://t.me/cvenotify/85451 · Telegram Post
• https://me.sap.com/notes/3490515 · Note
• https://twitter.com/vuldb/status/1810615765344850316 · Twitter Post