Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-41266

CVSS 8.0 · High EPSS 0.45% · P64
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-41266

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack.  As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP Commerce跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Commerce是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce Webservices 2.0若干版本存在跨站脚本漏洞，该漏洞源于其缺乏适当的输入验证允许攻击者通过恶意输入实现DOM型跨站脚本。攻击者可能能够窃取用户令牌并实现完整的帐户接管，包括访问SAP Commerce中的管理工具。以下版本受到影响：1905版本、2005版本、2105版本、2011版本、2205。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SAPCommerce Webservices 2.0 (Swagger UI) 1905 -

II. Public POCs for CVE-2022-41266

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-41266

请登录查看更多情报信息。

Same Patch Batch · SAP · 2022-12-13 · 9 CVEs total

CVE-2022-412679.9 CRITICALSAP Business Objects 代码问题漏洞
CVE-2022-412729.9 CRITICALSAP NetWeaver Process Integration 安全漏洞
CVE-2022-412719.4 CRITICALSAP NetWeaver Process Integration 安全漏洞
CVE-2022-412648.8 HIGHSAP Basis 代码注入漏洞
CVE-2022-412688.5 HIGH多款产品安全漏洞
CVE-2022-412746.5 MEDIUMSAP Disclosure Management 信息泄露漏洞
CVE-2022-412756.1 MEDIUMSAP Solution Manager 输入验证错误漏洞
CVE-2022-412734.3 MEDIUMSAP Sourcing和SAP Contract Lifecycle Management 1100 输入验证错误漏洞

IV. Related Vulnerabilities

Same vendor: SAP
Same weakness: CWE-79

V. Comments for CVE-2022-41266

No comments yet

Leave a comment