CVE-2021-40502

CVE-2021-40502

Vendor Sap Se
Product SAP Commerce
Weakness CWE-862 · Missing authorization
Published November 10, 2021
Last update August 4, 2024

CVSS base score

What the vulnerability does

01Description

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.

Key dates

02Disclosure timeline

November 10, 2021 CVE published
August 4, 2024 Record updated