{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-39597 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-39597 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-39597 is a high-severity missing authorization vulnerability in SAP_SE SAP Commerce, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-39597 and fix it if it is affected.\n\nWhat it is: CVE-2024-39597 is a high-severity missing authorization vulnerability in SAP_SE SAP Commerce, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-39597 in the wild and no public exploit code.\n\nAffected product: SAP_SE SAP Commerce. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-39597/ (Markdown: https://insights.sbomify.com/CVE-2024-39597/index.md)","id":"CVE-2024-39597","markdown":"https://insights.sbomify.com/CVE-2024-39597/index.md","name":"CVE-2024-39597","record":{"aliases":["GHSA-qj54-wmjw-h6gf"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["account_takeover","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"SAP Commerce","requires_auth":"none","summary":"Attackers can bypass merchant approval to access B2B sites via forgotten password flaws, potentially gaining unauthorized access to multiple sites.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"sap","cpe":[],"cvss":{"score":7.2,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"description":"In SAP Commerce, a user can misuse the forgotten\npassword functionality to gain access to a Composable Storefront B2B site for\nwhich early login and registration is activated, without requiring the merchant\nto approve the account beforehand. If the site is not configured as isolated\nsite, this can also grant access to other non-isolated early login sites, even\nif registration is not enabled for those other sites.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce","id":"CVE-2024-39597","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2024"},"n_packages":0,"n_references":2,"next":{"headline":"[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)","id":"CVE-2024-39598"},"packages":[],"prev":{"headline":"[CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now","id":"CVE-2024-39596"},"products":["SAP Commerce"],"published":"2024-07-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["SAP_SE"]},"summary":"Attackers can bypass merchant approval to access B2B sites via forgotten password flaws, potentially gaining unauthorized access to multiple sites.","url":"https://insights.sbomify.com/CVE-2024-39597/"}