SAP SE SAP Commerce
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-41204 | 1905 ; 2005 ; 2105 ; … | An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They ca | HIGH 8.8 | 0.9 % | ||
| CVE-2021-42064 | < 1905 ; < 2005 ; < 2105 ; … | If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP C | CRITICAL 9.8 | 1.1 % | ||
| CVE-2021-40502 | < 2105.3 ; < 2011.13 ; < 2005.18 ; … | SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, result | HIGH 8.8 | 0.8 % | ||
| CVE-2021-27602 | < 1808 ; < 1811 ; < 1905 ; … | SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which a | CRITICAL 9.9 | 2.0 % | ||
| CVE-2021-21477 | < 1808 ; < 1811 ; < 1905 ; … | SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticat | CRITICAL 9.9 | 30 % | ||
| CVE-2020-6302 | < 6.7 ; < 1808 ; < 1811 ; … | SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. A | HIGH 8.1 | 0.8 % | ||
| CVE-2020-6264 | < 6.7 ; < 1808 ; < 1811 ; … | SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise b | HIGH 8.6 | 1.0 % | ||
| CVE-2020-6265 | < 6.7 ; < 1808 ; < 1811 ; … | SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass | CRITICAL 9.8 | 1.4 % | ||
| CVE-2020-6238 | < 6.6 ; < 6.7 ; < 1808 ; … | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to | CRITICAL 9.3 | 1.3 % | ||
| CVE-2020-6232 | < 1811 ; < 1905 | SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check | MEDIUM 5.3 | 0.8 % |