Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0 (SAP_SE SAP Customer Checkout 2.0)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.09 % · percentile 0 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Awaiting Analysis
Description
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
Weaknesses (CWE)
- CWE-312 — Cleartext Storage of Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.6 | CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L | sap |
| CVSS 3.1 | MEDIUM 5.6 | CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-10446
- GCVE · GCVE-0-2026-24311
CERT-FR advisories
- CERTFR-2026-AVI-0256 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Customer Checkout 2.0 | affected SAP_CUSTOMER_CHECKOUT 2.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |