Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2021-27619

SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Alt

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP SE SAP Commerce (Backoffice Search)

  • < 1808affected
  • < 1811affected
  • < 1905affected
  • < 2005affected
  • < 2011affected

References