« Volver al listado

CVE-2021-40502

Estado: ModificadaAlta (8.8)—

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Commerce

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-40502",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "< 2105.3"
            },
            {
              "status": "affected",
              "version": "< 2011.13"
            },
            {
              "status": "affected",
              "version": "< 2005.18"
            },
            {
              "status": "affected",
              "version": "< 1905.34"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-10T16:15:08.673",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3110328",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3110328",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to."
    },
    {
      "lang": "es",
      "value": "SAP Commerce - versiones 2105.3, 2011.13, 2005.18, 1905.34, no realiza las comprobaciones de autorización necesarias para un usuario autenticado, lo que da lugar a una escalada de privilegios. Los atacantes autentificados podrán acceder y editar datos de unidades b2b a las que no pertenecen"
    }
  ],
  "lastModified": "2026-06-17T04:07:03.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:commerce:1905.34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78CBB227-38A7-4785-A6B1-7CE037E25C40"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2005.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80FD1F4D-9712-4B96-85ED-B8486DD8295D"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2011.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4A6EA65-350B-4132-BCB3-643CF857207D"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2105.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "985092A4-8595-4D2E-9DDE-056680F7EB06"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}