Lucene search

[email protected]CVE-2023-39439

HistoryAug 08, 2023 - 1:15 a.m.

CVE-2023-39439

2023-08-0801:15:19

CWE-1390

[email protected]

web.nvd.nist.gov

sap commerce cloud

cve-2023-39439

user authentication

security vulnerability

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

Affected configurations

NVD

Node

sapcommerce_cloudMatch2211

sapcommerce_hycomMatch2105

sapcommerce_hycomMatch2205

CPENameOperatorVersion
sap:commerce_cloudsap commerce cloudeq2211
sap:commerce_hycomsap commerce hycomeq2105
sap:commerce_hycomsap commerce hycomeq2205

CPE	Name	Operator	Version
sap:commerce_cloud	sap commerce cloud	eq	2211
sap:commerce_hycom	sap commerce hycom	eq	2105
sap:commerce_hycom	sap commerce hycom	eq	2205

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Commerce",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "HY_COM 2105"
      },
      {
        "status": "affected",
        "version": "HY_COM 2205"
      },
      {
        "status": "affected",
        "version": "COM_CLOUD 2211"
      }
    ]
  }
]

References

me.sap.com/notes/3346500

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVE-2023-39439

nvd1 cvelist1 prion1