CVE-2021-40502

{"id": "CVE-2021-40502", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-11-10T16:15:08.673", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3110328", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to."}, {"lang": "es", "value": "SAP Commerce - versiones 2105.3, 2011.13, 2005.18, 1905.34, no realiza las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, lo que da lugar a una escalada de privilegios. Los atacantes autentificados podr\u00e1n acceder y editar datos de unidades b2b a las que no pertenecen"}], "lastModified": "2021-11-28T23:21:21.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:commerce:1905.34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78CBB227-38A7-4785-A6B1-7CE037E25C40"}, {"criteria": "cpe:2.3:a:sap:commerce:2005.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80FD1F4D-9712-4B96-85ED-B8486DD8295D"}, {"criteria": "cpe:2.3:a:sap:commerce:2011.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4A6EA65-350B-4132-BCB3-643CF857207D"}, {"criteria": "cpe:2.3:a:sap:commerce:2105.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "985092A4-8595-4D2E-9DDE-056680F7EB06"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}