CVE-2023-42481

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-640

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-424827.5Samsung Mobile Processor Exynos 2200 allows a GPU Use After Free.CVE-2023-424834.7A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos CVE-2023-424867.8Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges.CVE-2023-424877.5Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-424887.5EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-424899.8EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource CVE-2023-42499.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.0 CVE-2023-424907.5EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2023-424919.8EisBaer Scada - CWE-285: Improper Authorization CVE-2023-424929.8EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key CVE-2023-424939.8EisBaer Scada - CWE-256: Plaintext Storage of a Password CVE-2023-424949.8EisBaer Scada - CWE-749: Exposed Dangerous Method or Function