Improper Access Control vulnerability in SAP Commerce Cloud

CVE-2023-42481

What is CVE-2023-42481?

In SAP Commerce Cloud, specifically in multiple versions such as HY_COM 1905 and others, an access control vulnerability allows a locked B2B user to exploit the forgotten password feature to restore their access. This misuse occurs particularly when the Composable Storefront is utilized, exposing significant risks to both confidentiality and integrity within the system. Weak access control measures fail to prevent unauthorized account recovery, raising concerns for organizations relying on SAP for secure e-commerce solutions.

References