CVE-2023-39439

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-258

Affected software

No affected versions have been published.

Timeline

Published: Aug 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-39446.1A vulnerability was found in phpscriptpoint Lawyer 1.6 and classified as problematic. Affected by this issue is some unknown functionality o CVE-2023-394404.4In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions me CVE-2023-394415.9Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Va CVE-2023-394437.8Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can CVE-2023-394447.8Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can CVE-2023-394458.8Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execu CVE-2023-394468.8Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the header CVE-2023-394474.4When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log. Note: Software ve CVE-2023-394488.8Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the CVE-2023-39456.1A vulnerability was found in phpscriptpoint Lawyer 1.6. It has been classified as problematic. This affects an unknown part of the file sear CVE-2023-394527.5The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can b CVE-2023-394539.8A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file