CVE-2020-6363: 
SAP Commerce Cloud vulnerability analysis and mitigation

SAP Commerce Cloud versions 1808, 1811, 1905, and 2005 were affected by a session management vulnerability identified as CVE-2020-6363. The vulnerability was discovered and disclosed in October 2020, affecting the web applications that maintain sessions with authenticated users (NVD).

The vulnerability is classified as Insufficient Session Expiration (CWE-613). When users change their passphrase, the system fails to invalidate active sessions, allowing potential session credential reuse. The vulnerability has a CVSS v3.1 Base Score of 4.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, indicating network accessibility with low attack complexity (NVD).

The vulnerability could allow attackers to reuse old session credentials even after a user has changed their passphrase, potentially leading to unauthorized access to user accounts and compromising the confidentiality and integrity of user data (NVD).

The vulnerability requires an attacker to have network access and a legitimate user to perform a password change action. The attack complexity is considered low, but privileged access and user interaction are required for successful exploitation (NVD).

SAP has released security patches to address this vulnerability. Organizations running affected versions of SAP Commerce Cloud should update to the latest patched version (SAP Advisory).