Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2022-41266

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which c

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack.  As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP Commerce Webservices 2.0 (Swagger UI)

Default version status: unaffected

  • 1905affected
  • 2005affected
  • 2105affected
  • 2011affected
  • 2205affected

References