CVE-2023-39439: 
SAP Commerce Cloud vulnerability analysis and mitigation

SAP Commerce Cloud contains a critical authentication vulnerability (CVE-2023-39439) that may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase. The vulnerability affects SAP Commerce HY_COM 2105, HY_COM 2205, and COM_CLOUD 2211 versions (ASEC Advisory, GBHackers Report).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while SAP SE rated it with a score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-258 (Empty Password in Configuration File) (NVD Database).

The vulnerability allows unauthorized access to the system through authentication bypass, potentially leading to complete system compromise with high impact on confidentiality, integrity, and availability of the application (GBHackers Report).

SAP has released security patches to address this vulnerability. Users of affected versions (SAP Commerce HY_COM 2105, HY_COM 2205, and COM_CLOUD 2211) are strongly advised to apply the latest security updates (ASEC Advisory).