CVE Vulnerability

CVE-2022-41266

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://launchpad.support.sap.com/#/notes/3248255 Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:sap:commerce_webservices_2.0:1905:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_webservices_2.0:2005:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_webservices_2.0:2105:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_webservices_2.0:2011:*:*:*:*:*:*:*
cpe:2.3:a:sap:commerce_webservices_2.0:2205:*:*:*:*:*:*:*
Information

Published : 2022-12-13 03:15

Updated : 2022-12-15 03:52

NVD link : CVE-2022-41266

Mitre link : CVE-2022-41266

Products Affected
No products.
CWE
CWE-79