Hard-coded credentials in SAP Commerce
Priority MEDIUM 45CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.
Why it matters now
EPSS 0.0136 71st percentileScored 2026-11-07
Fix Fixed SAP Commerce (SAP SE): 6.7, 1808, 1811 +1SAP Commerce (Data Hub) (SAP SE): 6.7, 1808, 1811 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Commerce | before 6.7; before 1808; before 1811; before 1905 | 6.7, 1808, 1811, 1905 | Patch available | CNA |
| SAP | SAP Commerce (Data Hub) | before 6.7; before 1808; before 1811; before 1905 | 6.7, 1808, 1811, 1905 | Patch available | CNA |
- SAP Commerce VendorSAP Affected before 6.7; before 1808; before 1811; before 1905 Fixed in 6.7, 1808, 1811, 1905 Patch available CNA
- SAP Commerce (Data Hub) VendorSAP Affected before 6.7; before 1808; before 1811; before 1905 Fixed in 6.7, 1808, 1811, 1905 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:commerce:6.7:*:*:*:*:*:*:* | 6.7 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce:1808:*:*:*:*:*:*:* | 1808 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce:1811:*:*:*:*:*:*:* | 1811 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:* | 1905 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_data_hub:6.7:*:*:*:*:*:*:* | 6.7 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_data_hub:1808:*:*:*:*:*:*:* | 1808 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_data_hub:1811:*:*:*:*:*:*:* | 1811 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_data_hub:1905:*:*:*:*:*:*:* | 1905 | Vulnerable | SAP |
- cpe:2.3:a:sap:commerce:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce:1808:*:*:*:*:*:*:* Versions 1808 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce:1811:*:*:*:*:*:*:* Versions 1811 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:* Versions 1905 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_data_hub:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_data_hub:1808:*:*:*:*:*:*:* Versions 1808 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_data_hub:1811:*:*:*:*:*:*:* Versions 1811 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_data_hub:1905:*:*:*:*:*:*:* Versions 1905 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Commerce (SAP SE) Fixed in 6.7, 1808, 1811, 1905
- Fix · CNA SAP Commerce (Data Hub) (SAP SE) Fixed in 6.7, 1808, 1811, 1905
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6265
- 2026-10-03 Alias added: GHSA-cqwc-4m4r-gw28
References
More SAP Commerce vulnerabilities
- TI-2021-04575 Code injection in SAP Commerce CVSS 3.1CRITICAL 9.9
- TI-2021-09054 Code injection in SAP Commerce CVSS 3.1CRITICAL 9.9
- TI-2021-18574 SQL injection in SAP Commerce CVSS 3.1CRITICAL 9.8
- TI-2022-19716 Open redirect in SAP Commerce CVSS 3.1HIGH 8.8
- TI-2021-17549 Missing authorization in SAP Commerce CVSS 3.1HIGH 8.8
- TI-2020-05154 Session fixation in SAP Commerce CVSS 3.1HIGH 8.1
Sources
- CVE-2020-6265 · CVE Program
- CVE-2020-6265 · NVD
- FIRST EPSS
- GHSA-cqwc-4m4r-gw28 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences