CVE-2021-27619

6.5MEDIUM

Key Information:

Vendor
SAP
Status
SAP Commerce (backoffice Search)
Vendor
CVE Published:
11 May 2021

Summary

SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.

Affected Version(s)

SAP Commerce (Backoffice Search) < 1808 < 1808

SAP Commerce (Backoffice Search) < 1811 < 1811

SAP Commerce (Backoffice Search) < 1905 < 1905

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3039818
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.