CVE-2021-27602

CVE-2021-27602 affects SAP Commerce Backoffice in versions 1808, 1811, 1905, 2005, 2011. The backoffice allows certain authorized users to create source rules, which are translated to Drools rules when published to certain modules. The vulnerability arises when an attacker with this authorization...

CVE-2022-41204

CVE-2022-41204 affects SAP Commerce versions 1905–2205 and targets the login page. A manipulated URL can inject client-side code to change the login form submission, redirecting data to an attacker-controlled server. This enables credential theft and account hijacking, impacting confidentiality, ...

CVE-2021-42064

SAP Commerce (versions 1905, 2005, 2105, 2011) is vulnerable when configured to use Oracle DB and a query is built with the Flexible Search Java API using a parameterized IN clause that accepts more than 1000 values. The root cause is not explicitly described beyond this parameterized IN clause b...

CVE-2021-21477

CVE-2021-21477 affects SAP Commerce Cloud versions 1808, 1811, 1905, 2005 and 2011. A misconfiguration of default user permissions lets certain users with required privileges edit DroolsRule ruleContents, enabling injection of malicious code that leads to Remote Code Execution and impacts confide...

CVE-2021-27619

The CVE-2021-27619 issue affects SAP Commerce (Backoffice Search) and is present in versions 1808, 1811, 1905, 2005, and 2011. A low-privilege user can perform a masked attribute search and, by iteratively entering one character at a time, infer the actual value of masked attributes, resulting in...