CVE-2023-42481: Improper Access Control vulnerability in SAP Commerce Cloud
In SAP Commerce Cloud - versions HYCOM 1905, HYCOM 2005, HYCOM2105, HYCOM 2011, HYCOM 2205, COMCLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42481?
The severity of CVE-2023-42481 is classified as medium.
How do I fix CVE-2023-42481?
To fix CVE-2023-42481, apply the recommended patches provided by SAP for affected versions of SAP Commerce Cloud.
Which versions of SAP Commerce Cloud are affected by CVE-2023-42481?
CVE-2023-42481 affects SAP Commerce Cloud versions HY_COM 1905, HY_COM 2005, HY_COM 2105, HY_COM 2011, HY_COM 2205, and COM_CLOUD 2211.
What is the impact of CVE-2023-42481?
CVE-2023-42481 allows a locked B2B user to misuse the forgotten password functionality to regain access to their account.
What actions should be taken if I am using a vulnerable version of SAP Commerce Cloud?
If using a vulnerable version of SAP Commerce Cloud, it is advisable to upgrade to a patched version immediately to mitigate risks.