CVE-2022-41204

published 2022-10-11

CVE-2022-41204: An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that…

Priority P3 45 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap_se	sap_commerce	—	—
sap_se	sap_commerce	—	—
sap_se	sap_commerce	—	—
sap_se	sap_commerce	—	—
sap_se	sap_commerce	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601