CVE-2023-42481highCWE-640

CVE-2023-42481: high-severity vulnerability in SAP_SE SAP Commerce Cloud

Improper Access Control vulnerability in SAP Commerce Cloud

Published · Updated

Follow this CVE+ Monitor SAP Commerce Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.5%
In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
SAP_SE · SAP Commerce Cloud
Related CVEs — SAP_SE SAP Commerce Cloud

In the same product, most dangerous first.

CVE-2026-44761CRITICALInsecure Sample Credentials in SAP Commerce CloudEPSS 0.5%CVE-2024-33003HIGHInformation Disclosure Vulnerability in SAP Commerce CloudEPSS 0.5%CVE-2025-42906MEDIUMDirectory Traversal vulnerability in SAP Commerce CloudEPSS 0.4%CVE-2026-24321MEDIUMInformation Disclosure vulnerability in SAP Commerce CloudEPSS 0.2%CVE-2025-27435MEDIUMInformation Disclosure Vulnerability in SAP Commerce CloudEPSS 0.2%CVE-2024-47577LOWInformation Disclosure vulnerability in SAP Commerce CloudEPSS 0.2%