CVE-2023-42481— Improper Access Control vulnerability in SAP Commerce Cloud
Quick assessment
Affected
SAP_SE SAP Commerce Cloud
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Commerce Cloud是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce Cloud 8.1版本存在访问控制错误漏洞，该漏洞源于用户可以滥用忘记密码功能再次解锁其用户帐户并重新获得访问权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-42481
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Access Control vulnerability in SAP Commerce Cloud
Source: CVE Program / CVE List V5
Vulnerability Description
In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Commerce Cloud 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Commerce Cloud是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce Cloud 8.1版本存在访问控制错误漏洞，该漏洞源于用户可以滥用忘记密码功能再次解锁其用户帐户并重新获得访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Commerce Cloud | HY_COM 1905 | - |
|
II. Public POCs for CVE-2023-42481
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-42481
请登录查看更多情报信息。
Other References for CVE-2023-42481 (2)
Same Patch Batch · SAP_SE · 2023-12-12 · 16 CVEs total
| CVE-2023-49583 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/ |
| CVE-2023-50422 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-se |
| CVE-2023-50423 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud- |
| CVE-2023-50424 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github |
| CVE-2023-42478 | 7.5 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Plat |
| CVE-2023-49580 | 7.3 HIGH | Information disclosure in SAP GUI for Windows and SAP GUI for Java |
| CVE-2023-6542 | 7.1 HIGH | Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID |
| CVE-2023-42476 | 6.8 MEDIUM | Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence |
| CVE-2023-49587 | 6.4 MEDIUM | Command Injection vulnerability in SAP Solution Manager |
| CVE-2023-42479 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct |
| CVE-2023-49577 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution) |
| CVE-2023-49584 | 4.3 MEDIUM | Client-Side Desynchronization vulnerability in SAP Fiori Launchpad |
| CVE-2023-49581 | 4.1 MEDIUM | SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2023-49058 | 3.5 LOW | Directory Traversal vulnerability in SAP Master Data Governance |
| CVE-2023-49578 | 3.5 LOW | Denial of service (DOS) in SAP Cloud Connector |
IV. Related Vulnerabilities
Same product: SAP Commerce Cloud
-
CVE-2026-44761
Insecure Sample Credentials in SAP Commerce Cloud -
CVE-2026-24321
Information Disclosure vulnerability in SAP Commerce Cloud -
CVE-2026-23684
Race condition vulnerability in SAP Commerce Cloud -
CVE-2025-42906
Directory Traversal vulnerability in SAP Commerce Cloud -
CVE-2025-27435
Information Disclosure Vulnerability in SAP Commerce Cloud
Same vendor: SAP_SE
-
CVE-2026-66766
Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protec -
CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt -
CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-640
-
CVE-2026-19632
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Acc -
CVE-2026-80196
Kimai before 2.58.0 Authentication Bypass via Password Reset -
CVE-2026-77264
Automation Web Platform <= 4.8.6 - Unauthenticated Authentic -
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated accoun -
CVE-2026-15689
Dancer2::Plugin::Auth::Extensible versions through 0.713 for
V. Comments for CVE-2023-42481
No comments yet