VYPR
← All advisories
High severity8.1NVD Advisory· Published Dec 12, 2023· Updated Jun 17, 2026

CVE-2023-42481

CVE-2023-42481

Description

In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.

Affected products

4
  • SAP/Commerce Cloud3 versions
    cpe:2.3:a:sap:commerce_cloud:8.1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:sap:commerce_cloud:8.1:*:*:*:*:*:*:*
    • (no CPE)range: HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211
    • (no CPE)range: HY_COM 1905
  • SAP/Composable Storefrontllm-create
    Range: HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.