CVE-2023-39439
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
Risk Assessment
The lack of a passphrase requirement poses a serious risk of unauthorized access to the system, potentially leading to data loss or security breaches.
Recommendation
It is recommended to configure the system to require a non-empty passphrase during login, which will enhance user security.
Other vulnerabilities in SAP Commerce Cloud
See all- CVE-2026-58231Critical
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability.
- CVE-2026-44761Critical
SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.
- CVE-2026-34263Critical
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution.
Original NVD description (English source)
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.