CVE-2021-21445: SAP Commerce Cloud

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking.

Affected products

• SAP Commerce Cloud: version 1808 only; version 1811 only; version 1905 only; version 2005 only; version 2011 only

Published 2021-01-12. Last modified 2026-06-17.