Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-39597— [CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce

Quick assessment

Affected
SAP_SE SAP Commerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SAP Commerce是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce 存在授权问题漏洞，该漏洞源于用户可以滥用忘记密码功能，获得对已激活早期登录和注册的可组合商店B2B网站的访问权限，而无需商家事先批准账户。如果网站未配置为隔离站点，这也可以授予对其他非隔离早期登录站点的访问权限，即使这些其他站点未启用注册。

CVSS 7.2 · High EPSS 0.28% · P19

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-39597

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce
Source: CVE Program / CVE List V5
Vulnerability Description
In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as isolated site, this can also grant access to other non-isolated early login sites, even if registration is not enabled for those other sites.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Commerce 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Commerce是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce 存在授权问题漏洞，该漏洞源于用户可以滥用忘记密码功能，获得对已激活早期登录和注册的可组合商店B2B网站的访问权限，而无需商家事先批准账户。如果网站未配置为隔离站点，这也可以授予对其他非隔离早期登录站点的访问权限，即使这些其他站点未启用注册。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
SAP_SE SAP Commerce HY_COM 2205 -

II. Public POCs for CVE-2024-39597

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-39597

请登录查看更多情报信息。

Other References for CVE-2024-39597 (1)

Same Patch Batch · SAP_SE · 2024-07-09 · 18 CVEs total

CVE-2024-39592 7.7 HIGH [CVE-2024-39592] Missing Authorization check in SAP PDCE
CVE-2024-39593 6.9 MEDIUM [CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape Management
CVE-2024-34685 6.1 MEDIUM [CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Manag
CVE-2024-37173 6.1 MEDIUM [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-37174 6.1 MEDIUM [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-39594 6.1 MEDIUM [CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Wareh
CVE-2024-39595 5.4 MEDIUM [CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Wareh
CVE-2024-37172 5.4 MEDIUM [CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Mana
CVE-2024-34689 5.0 MEDIUM [CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)
CVE-2024-39598 5.0 MEDIUM [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-39600 5.0 MEDIUM [CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows
CVE-2024-37171 5.0 MEDIUM [CVE-2024-37171] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Coll
CVE-2024-39599 4.7 MEDIUM [CVE-2024-39599] Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP
CVE-2024-37175 4.3 MEDIUM [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-39596 4.3 MEDIUM [CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now
CVE-2024-37180 4.1 MEDIUM [CVE-2024-37180] Information Disclosure vulnerability in SAP NetWeaver Application Server
CVE-2024-34692 3.3 LOW [CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now

IV. Related Vulnerabilities

Same product: SAP Commerce
Same vendor: SAP_SE
Same weakness: CWE-285

V. Comments for CVE-2024-39597

No comments yet

Leave a comment