FKIE_CVE-2026-24311

Vulnerability from fkie_nvd - Published: 2026-03-10 17:35 - Updated: 2026-03-11 13:53
Severity ?
5.6 (Medium) - CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Summary
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
References
cna@sap.comhttps://me.sap.com/notes/3708457
cna@sap.comhttps://url.sap/sapsecuritypatchday
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application\u0027s confidentiality and integrity, with a low impact on availability."
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n SAP Customer Checkout presenta ciertas caracter\u00edsticas de dise\u00f1o que implican el almacenamiento local de datos operativos utilizando mecanismos de protecci\u00f3n reversibles. El acceso a estos datos, combinado con la interacci\u00f3n iniciada por el usuario, puede permitir que se produzcan modificaciones sin validaci\u00f3n. Dichos cambios podr\u00edan afectar el comportamiento del sistema durante el inicio, lo que resultar\u00eda en un alto impacto en la confidencialidad e integridad de la aplicaci\u00f3n, con un bajo impacto en la disponibilidad."
    }
  ],
  "id": "CVE-2026-24311",
  "lastModified": "2026-03-11T13:53:47.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "LOW",
          "baseScore": 5.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.1,
        "impactScore": 5.5,
        "source": "cna@sap.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-10T17:35:55.360",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/3708457"
    },
    {
      "source": "cna@sap.com",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ],
      "source": "cna@sap.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.