Vulnerability · Published May 11, 2021 · Assigned by sap
CVE-2021-27619
Medium 6.5
In plain English
A medium-severity security flaw in SAP Commerce (Backoffice Search) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.0)6.5Medium
Exploit odds (30 days)0.8%top 42.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Commerce (Backoffice Search) | < 1808< 1811< 1905< 2005< 2011 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3039818 x_refsource_MISC