CVE-2022-41266: SAP Commerce Webservices 2.0

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack.  As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.

Affected products

• SAP Commerce Webservices 2.0: version 1905 only; version 2005 only; version 2011 only; version 2105 only; version 2205 only

Published 2022-12-13. Last modified 2026-06-17.