« Volver al listado

CVE-2024-41733

Estado: AnalizadaMedia (5.3)—

In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality therefore is low and no impact to integrity or availability

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Commerce

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41733",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41733",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-13T14:36:37.582079Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "HY_COM 2205"
            },
            {
              "status": "affected",
              "version": "COM_CLOUD 2211"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap:commerce_cloud:2211:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "commerce_cloud",
          "versions": [
            {
              "status": "affected",
              "version": "2211"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:commerce_hycom:2205:*:*:*:*:*:*:*"
          ],
          "vendor": "sap",
          "product": "commerce_hycom",
          "versions": [
            {
              "status": "affected",
              "version": "2205"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-08-13T04:15:08.987",
  "references": [
    {
      "url": "https://me.sap.com/notes/3471450",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In SAP Commerce, valid user accounts can be\nidentified during the customer registration and login processes. This allows a\npotential attacker to learn if a given e-mail is used for an account, but does\nnot grant access to any customer data beyond this knowledge. The attacker must\nalready know the e-mail that they wish to test for. The impact on\nconfidentiality therefore is low and no impact to integrity or availability"
    },
    {
      "lang": "es",
      "value": "En SAP Commerce, las cuentas de usuario válidas se pueden identificar durante los procesos de registro e inicio de sesión del cliente. Esto permite a un atacante potencial saber si un correo electrónico determinado se utiliza para una cuenta, pero no otorga acceso a ningún dato del cliente más allá de este conocimiento. El atacante ya debe conocer el correo electrónico que desea probar. Por lo tanto, el impacto sobre la confidencialidad es bajo y no afecta la integridad o la disponibilidad."
    }
  ],
  "lastModified": "2026-06-17T07:48:09.203",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:commerce:com_cloud_2211:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9675EB72-CE1B-44EB-830C-5EE3760B4E8C"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:hy_com_2205:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D604185-AD43-4C48-8B43-ADC9560A677E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}