CVE-2026-24311

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24311", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-21T22:15:25.361Z", "datePublished": "2026-03-10T00:17:30.184Z", "dateUpdated": "2026-03-10T16:53:26.731Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:17:30.184Z"}, "title": "Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Customer Checkout 2.0", "versions": [{"status": "affected", "version": "SAP_CUSTOMER_CHECKOUT 2.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3708457"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.6, "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T15:39:53.522984Z", "id": "CVE-2026-24311", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T16:53:26.731Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24311", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T15:39:53.522984Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:39:54.737Z"}}], "cna": {"title": "Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Customer Checkout 2.0", "versions": [{"status": "affected", "version": "SAP_CUSTOMER_CHECKOUT 2.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3708457"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.", "supportingMedia": [{"type": "text/html", "value": "<p>The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:17:30.184Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24311", "state": "PUBLISHED", "dateUpdated": "2026-03-10T16:53:26.731Z", "dateReserved": "2026-01-21T22:15:25.361Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-03-10T00:17:30.184Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Customer Checkout 2.0", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SAP_CUSTOMER_CHECKOUT 2.0"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability."}, {"lang": "es", "value": "La aplicaci\u00f3n SAP Customer Checkout presenta ciertas caracter\u00edsticas de dise\u00f1o que implican el almacenamiento local de datos operativos utilizando mecanismos de protecci\u00f3n reversibles. El acceso a estos datos, combinado con la interacci\u00f3n iniciada por el usuario, puede permitir que se produzcan modificaciones sin validaci\u00f3n. Dichos cambios podr\u00edan afectar el comportamiento del sistema durante el inicio, lo que resultar\u00eda en un alto impacto en la confidencialidad e integridad de la aplicaci\u00f3n, con un bajo impacto en la disponibilidad."}], "id": "CVE-2026-24311", "lastModified": "2026-06-17T10:22:52.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.1, "impactScore": 5.5, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24311", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T15:39:53.522984Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:35:55.360", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3708457"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_CUSTOMER_CHECKOUT 2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SAP Customer Checkout 2.0", "source": "cna", "vendor": "SAP_SE"}, "product": "sap_customer_checkout_2.0", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-16T09:57:50.592149+00:00", "value": {"mitigation_remediation": ["Apply the latest available patch or upgrade SAP Customer Checkout to a version that resolves reversible storage handling.", "Restrict user privileges that allow initiating the modification flow, ensuring only authorized personnel can trigger such actions.", "Configure or enforce stronger storage protection, such as using encryption or non\u2011reversible hashing for operational data, to prevent unauthorized tampering.", "Monitor application logs for unexpected changes to operational data during startup and set alerts for suspicious activity."], "summary": {"action": "Assess Impact", "impact": "Potential Confidentiality and Integrity Violations via unauthorized modification of operational data"}, "threat_synthesis": {"affected_systems": "SAP Customer Checkout 2.0. No specific version details are provided, so all releases of this product are potentially affected until an official patch becomes available.", "description_and_impact": "The vulnerability arises from the SAP Customer Checkout application storing operational data locally with reversible protection mechanisms. When a user initiates certain interactions, those operations can modify the stored data without proper validation, allowing unauthorized changes that can affect system behavior during startup. This scenario compromises the application's confidentiality and integrity, but has a low impact on availability.", "risk_and_exploitability": "The CVSS score is 5.6, indicating a moderate severity. The EPSS score is less than 1%, suggesting that the likelihood of exploitation in the near term is low. The vulnerability is not listed in the CISA KEV catalog, further supporting a lower risk posture. The attack can be performed by a user who can trigger the local data modification flow, typically through the application\u2019s user interface, implying that the primary vector is a local or user-initiated interaction."}}}}, "created": "2026-03-10T14:06:17.608572+00:00", "updated": "2026-04-16T10:00:14.099560+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_customer_checkout_2.0"]}