SAP Commerce Vulnerability: Misuse of Forgotten Password Functionality Can Grant Access to Non-Isolated Sites

CVE-2024-39597

Summary

The vulnerability in SAP Commerce allows a user to exploit the forgotten password functionality, enabling them to gain unauthorized access to a Composable Storefront B2B site where early login and registration features are active. This security issue becomes more critical if the site is not configured to operate as an isolated instance. In such cases, attackers may gain access not only to the vulnerable site but also to other non-isolated early login sites, even if registration is disabled on those platforms. Proper configuration and review of user account approval processes are essential in mitigating this vulnerability.

References