CVE-2021-21445
5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP SE | SAP Commerce Cloud | < 1808 | affected |
| SAP SE | SAP Commerce Cloud | < 1811 | affected |
| SAP SE | SAP Commerce Cloud | < 1905 | affected |
| SAP SE | SAP Commerce Cloud | < 2005 | affected |
| SAP SE | SAP Commerce Cloud | < 2011 | affected |
Weaknesses
- Header Manipulation
ADP Enrichment
CVE Program Container
Additional References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
- https://launchpad.support.sap.com/#/notes/2984034
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
- https://launchpad.support.sap.com/#/notes/2984034
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.