SAP Commerce vulnerabilities

3 known vulnerabilities in SAP Commerce from SAP. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  SAP Commerce: Improper Authorization

  CVE-2024-39597Jul 9, 2024SAP

  In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not

• 9.8 Critical severity

  SAP Commerce: Empty Password in Configuration File

  CVE-2023-39439Aug 8, 2023SAP

  SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

• 8.8 High severity

  SAP Commerce: URL Redirection to Untrusted Site

  CVE-2022-41204Oct 11, 2022SAP

  An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows the