Riskcovery

CVE-2022-41266

State
Published
Severity
8.0 High
Published
Dec 13, 2022
Updated
Apr 22, 2025
Reserved
Sep 21, 2022

Read the record on cve.org

Description

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack.  As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.

Scores

CVSSScoreVectorSource
3.18.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Nsap

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
Commerce Webservices 2.0 (Swagger UI)SAP
  • 1905Affected
  • 2005Affected
  • 2105Affected
  • 2011Affected
  • 2205Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.