// For flags

CVE-2022-41204

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.

Un atacante puede cambiar el contenido de una página de inicio de sesión de SAP Commerce - versiones 1905, 2005, 2105, 2011, 2205, mediante una URL manipulada. Pueden inyectar código que les permita redirigir los envíos del formulario de inicio de sesión afectado a su propio servidor. Esto les permite robar credenciales y secuestrar cuentas. Un ataque con éxito podría comprometer la Confidencialidad, Integridad y Disponibilidad del sistema

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-21 CVE Reserved
  • 2022-10-11 CVE Published
  • 2024-05-03 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sap
Search vendor "Sap"
 Commerce
Search vendor "Sap" for product "Commerce"
 1905
Search vendor "Sap" for product "Commerce" and version "1905"
-
Affected
Sap
Search vendor "Sap"
 Commerce
Search vendor "Sap" for product "Commerce"
 2005
Search vendor "Sap" for product "Commerce" and version "2005"
-
Affected
Sap
Search vendor "Sap"
 Commerce
Search vendor "Sap" for product "Commerce"
 2011
Search vendor "Sap" for product "Commerce" and version "2011"
-
Affected
Sap
Search vendor "Sap"
 Commerce
Search vendor "Sap" for product "Commerce"
 2105
Search vendor "Sap" for product "Commerce" and version "2105"
-
Affected
Sap
Search vendor "Sap"
 Commerce
Search vendor "Sap" for product "Commerce"
 2205
Search vendor "Sap" for product "Commerce" and version "2205"
-
Affected