Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2023-39439

SAP Commerce accepts empty passphrases.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP Commerce

Default version status: unaffected

  • HY_COM 2105affected
  • HY_COM 2205affected
  • COM_CLOUD 2211affected

References