CVE-2026-24311
Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
- Record
CVE-2026-24311- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-312
- Updated
- 2026-11-02
EUVDEUVD-2026-10446
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
- Record
EUVD-2026-10446- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j8g4-mcwm-v999
The SAP Customer Checkout application exhibits certain design characteristics that involve...
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
- Record
GHSA-j8g4-mcwm-v999- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-312
- Updated
- 2026-11-02
NVD
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
- Record
CVE-2026-24311- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-312
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-24311 is a medium vulnerability (CVSS 5.6) in Sap Se Customer Checkout 2.0, published March 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. No source names a fixed version.