Advisory
On 12.12.2023 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Commerce.
SAP Note 3394567 addresses "[CVE-2023-42481] Improper Access Control vulnerability in SAP Commerce Cloud" to prevent missing authentication check / improper authentication check with a high risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specification
SAP Commerce Cloud allows authenticated attacker to misuse the forgotten password functionality to unblock his BSB user account and regain access again when the SAP Commerce Cloud component Composable Storefront is used as storefront.Solution
The vulnerability by not changing the loginDisabled flag to false if the B2B user is marked as inactive during the password reset flow is now fixed. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "Establish the following as a procedure during operations: Immediately after a B2B user is blocked by a B2B user with admin role, the ID or the email of the blocked user is adjusted in the backoffice. By doing so, the blocked user can no longer receive e-mails to unblock their user if the ID or email are set accordingly.".
The advisory is valid for
- COM_CLOUD 2211 9
- HY_COM 1905 26
- HY_COM 2005 22
- HY_COM 2011 16
- HY_COM 2105 15
- HY_COM 2205 14
