← CVE Intelligence

CVE-2024-39597

[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce PUBLISHED

Description (CNA)

In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as isolated site, this can also grant access to other non-isolated early login sites, even if registration is not enabled for those other sites.

Affected (CNA)

Vendor / productVersions
SAP_SE / SAP Commerceaffected HY_COM 2205; affected COM_CLOUD 2211

CWE

CWE-285

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.