CVE-2024-41733: falha de média gravidade em SAP_SE SAP Commerce
Information Disclosure Vulnerability in SAP Commerce
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
In SAP Commerce, valid user accounts can be
identified during the customer registration and login processes. This allows a
potential attacker to learn if a given e-mail is used for an account, but does
not grant access to any customer data beyond this knowledge. The attacker must
already know the e-mail that they wish to test for. The impact on
confidentiality therefore is low and no impact to integrity or availability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
SAP_SE · SAP CommerceCVEs relacionadas — SAP_SE SAP Commerce
No mesmo produto, das mais perigosas para as menos.
CVE-2023-39439HIGHSAP Commerce accepts empty passphrases.EPSS 0.7%CVE-2024-39597HIGH[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP CommerceEPSS 0.3%CVE-2025-24875MEDIUMSameSite Defense in Depth not applied for some cookies in SAP CommerceEPSS 0.2%