CVE-2023-39439CWE-258

SAP Commerce accepts empty passphrases.

High · published August 8, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00713 · 53.1th percentile
Weakness
CWE-258 · Empty Password in Configuration File
Published
2023-08-08T00:49Z
EPSS history
Timeline
  • 08 AUG 00:49Z
    SAP Commerce accepts empty passphrases.
    cvelistv5