CVE-2021-40502

CWE-862 — Missing AuthorizationCWE-2853 documents3 sources
Severity
8.8HIGH
EPSS
0.4%
top 42.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP CommerceSAP Commerce
Timeline
PublishedNov 10
Latest updateMay 24

Description

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5sap_se/sap_commerce< 2105.3+3
▶NVDsap/commerce4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-grp2-x34r-x38c: SAP Commerce - versions 2105↗2022-05-24
▶
CVEList
CVE-2021-40502: SAP Commerce - versions 2105↗2021-11-10
▶
CVE-2021-40502 (HIGH CVSS 8.8) | SAP Commerce - versions 2105.3 | cvebase.io