Authentication flaw

2023-08-0801:15:00

PRIOn knowledge base

www.prio-n.com

sap commerce

empty passphrase

authentication flaw

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

CPENameOperatorVersion
commerce_cloudeq2211
commerce_hycomeq2205
commerce_hycomeq2105

Name	Operator	Version
commerce_cloud	eq	2211
commerce_hycom	eq	2205
commerce_hycom	eq	2105

References

me.sap.com/notes/3346500

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html