CVE-2021-21445

CWE-444 — HTTP Request Smuggling3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 60.61%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SAP SE SAP Commerce Cloud SAP Commerce Cloud

Timeline

PublishedJan 12

Latest updateMay 24

Description

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5sap_se/sap_commerce_cloud< 1808+4

▶NVDsap/commerce_cloud5 versions+4

🔴Vulnerability Details

GHSA

GHSA-w4g5-mcc7-3767: SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content↗2022-05-24

▶

CVEList

CVE-2021-21445: SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content↗2021-01-12

▶