« Volver al listado

CVE-2022-41204

Estado: ModificadaAlta (8.8)—

An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Commerce

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-41204",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-41204",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-20T15:07:43.016241Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "1905"
            },
            {
              "status": "affected",
              "version": "2005"
            },
            {
              "status": "affected",
              "version": "2105"
            },
            {
              "status": "affected",
              "version": "2011"
            },
            {
              "status": "affected",
              "version": "2205"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-11T21:15:26.377",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3239152",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3239152",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system."
    },
    {
      "lang": "es",
      "value": "Un atacante puede cambiar el contenido de una página de inicio de sesión de SAP Commerce - versiones 1905, 2005, 2105, 2011, 2205, mediante una URL manipulada. Pueden inyectar código que les permita redirigir los envíos del formulario de inicio de sesión afectado a su propio servidor. Esto les permite robar credenciales y secuestrar cuentas. Un ataque con éxito podría comprometer la Confidencialidad, Integridad y Disponibilidad del sistema"
    }
  ],
  "lastModified": "2026-06-17T05:02:46.677",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F665F648-5C35-4EC8-8064-8ED139C8813C"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C788164A-7724-4CB1-8ADC-B05ADE595020"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DE31C0C-31D7-468E-B1D4-CE522086EDD3"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2105:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BF52269-A749-4A58-A291-ACD4C41C6FAF"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2205:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "346C80E4-1D32-4857-8752-F7A8C9492600"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}