PT-2022-25727 · Sap · Sap Commerce

Published 2022-10-11 · Updated 2025-05-20 · CVE-2022-41204

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Commerce versions 1905 through 2205

Description An attacker can change the content of the SAP Commerce login page through a manipulated URL, allowing them to inject code that redirects submissions from the affected login form to their own server. This enables them to steal credentials and hijack accounts, potentially compromising the Confidentiality, Integrity, and Availability of the system.

Recommendations For versions 1905 through 2205, consider restricting access to the login page until a fix is available, and avoid using manipulated URLs to prevent code injection. As a temporary workaround, consider disabling the login form submission functionality until a patch is available.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-41204

Affected Products

Sap Commerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-41204 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41204 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3239152 · Vendor Advisory
• https://t.me/isacarusec/5697 · Telegram Post
• https://t.me/cvenotify/123071 · Telegram Post
• https://t.me/true_secator/3562 · Telegram Post
• https://t.me/cibsecurity/51199 · Telegram Post