PT-2021-22909 · Sap · Sap Commerce

Published 2021-11-10 · Updated 2021-11-28 · CVE-2021-40502

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Commerce versions 1905.34, 2005.18, 2011.13, 2105.3

Description The issue results from the lack of necessary authorization checks for authenticated users, leading to escalation of privileges. Authenticated attackers can access and edit data from b2b units they do not belong to.

Recommendations For versions 1905.34, 2005.18, 2011.13, 2105.3, update to a version that includes the necessary authorization checks to prevent escalation of privileges. As a temporary workaround, consider restricting access to sensitive b2b unit data until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-40502

Affected Products

Sap Commerce

References · 6

• https://launchpad.support.sap.com/#/notes/3110328 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40502 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864 · Vendor Advisory
• https://t.me/cibsecurity/32164 · Telegram Post
• https://t.me/true_secator/2303 · Telegram Post