Information Disclosure Vulnerability in SAP Commerce Backoffice Search

CVE-2021-27619

Summary

SAP Commerce, specifically within its Backoffice Search functionality, presents a vulnerability where low privileged users can perform searches for attributes intended to remain concealed. Despite the search results being masked, users can exploit the system by incrementally inputting characters, enabling them to reveal sensitive attribute values and leading to potential information disclosure. This flaw poses risks to the confidentiality of user data and requires prompt attention to mitigate potential exposure.

References