mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 17:21:36 +00:00
127 lines
4.3 KiB
JSON
127 lines
4.3 KiB
JSON
{
|
|
"id": "CVE-2022-41266",
|
|
"sourceIdentifier": "cna@sap.com",
|
|
"published": "2022-12-13T03:15:09.507",
|
|
"lastModified": "2023-11-07T03:52:45.320",
|
|
"vulnStatus": "Modified",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack. \u00a0As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Debido a la falta de una validaci\u00f3n de entrada adecuada, SAP Commerce Webservices 2.0 (Swagger UI): versiones 1905, 2005, 2105, 2011, 2205, permite entradas maliciosas de fuentes no confiables, que un atacante puede aprovechar para ejecutar un ataque de cross site scripting DOM (XSS). Como resultado, un atacante puede robar tokens de usuario y lograr el control total de la cuenta, incluido el acceso a herramientas administrativas en SAP Commerce."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 6.1,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 2.7
|
|
},
|
|
{
|
|
"source": "cna@sap.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 8.0,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 1.6,
|
|
"impactScore": 5.8
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "cna@sap.com",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-79"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:sap:commerce_webservices_2.0:1905:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "91CCD1DB-79F7-4A2F-88F6-3455118E14C9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:sap:commerce_webservices_2.0:2005:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "124471DF-DDA0-4A73-8224-10D2F0BD6CCF"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:sap:commerce_webservices_2.0:2011:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "63B2356C-28B7-4EAF-BC5C-C13F0F6A76B6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:sap:commerce_webservices_2.0:2105:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5938B02B-2282-4925-90AE-7FAE0C19E4B2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:sap:commerce_webservices_2.0:2205:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "1D42EE48-9073-4507-AC40-D9B8A926D6DB"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://launchpad.support.sap.com/#/notes/3248255",
|
|
"source": "cna@sap.com",
|
|
"tags": [
|
|
"Permissions Required",
|
|
"Vendor Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
|
|
"source": "cna@sap.com",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |