CVE-2021-21445: sap_se sap commerce cloud HTTP Request/Response Smuggling

Vulnerability summary

CVE-2021-21445 is a medium (CVSS 5.4) HTTP Request/Response Smuggling vulnerability in sap_se sap commerce cloud. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 50.1% of scored vulnerabilities.

Timeline

1. 12-01-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking.

• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.