CVE-2022-41204: sap_se sap commerce Open Redirect

Vulnerability summary

CVE-2022-41204 is a high (CVSS 8.8) Open Redirect vulnerability in sap_se sap commerce. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.5% of scored vulnerabilities.

Timeline

1. 11-10-2022
   PublishedVulnerability first disclosed.
2. 20-05-2025
   Last modifiedVulnerability information updated.

Description

An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.