SAP Commerce vulnerabilities

10 CVEs affecting SAP Commerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-41733, published 2024-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21477, published 2021-02-09. Critical severity, CVSS 9.9. EPSS: 29.8% chance of exploitation in the next 30 days. SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject…
CVE-2021-27602, published 2021-04-13. Critical severity, CVSS 9.9. EPSS: 2% chance of exploitation in the next 30 days. SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain…
CVE-2020-6265, published 2020-06-09. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been…
CVE-2021-42064, published 2021-12-14. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker…
CVE-2020-6264, published 2020-06-10. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure.
CVE-2022-41204, published 2022-10-11. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from…
CVE-2021-40502, published 2021-11-10. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers…
CVE-2021-27619, published 2021-05-11. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search…
CVE-2020-6302, published 2020-09-09. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or…
CVE-2024-41733, published 2024-08-13. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but…