Missing authorization in SAP Commerce
Priority MEDIUM 40CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.
Why it matters now
EPSS 0.00828 57th percentileScored 2026-11-07
Fix Fixed SAP Commerce (SAP SE): 2105.3, 2011.13, 2005.18 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Commerce | before 2105.3; before 2011.13; before 2005.18; before 1905.34 | 2105.3, 2011.13, 2005.18, 1905.34 | Patch available | CNA |
- SAP Commerce VendorSAP Affected before 2105.3; before 2011.13; before 2005.18; before 1905.34 Fixed in 2105.3, 2011.13, 2005.18, 1905.34 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:commerce:1905.34:*:*:*:*:*:*:* | 1905.34 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce:2005.18:*:*:*:*:*:*:* | 2005.18 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce:2011.13:*:*:*:*:*:*:* | 2011.13 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce:2105.3:*:*:*:*:*:*:* | 2105.3 | Vulnerable | SAP |
- cpe:2.3:a:sap:commerce:1905.34:*:*:*:*:*:*:* Versions 1905.34 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce:2005.18:*:*:*:*:*:*:* Versions 2005.18 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce:2011.13:*:*:*:*:*:*:* Versions 2011.13 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce:2105.3:*:*:*:*:*:*:* Versions 2105.3 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Commerce (SAP SE) Fixed in 2105.3, 2011.13, 2005.18, 1905.34
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40502
- 2026-10-03 Alias added: GHSA-grp2-x34r-x38c
References
More SAP Commerce vulnerabilities
- TI-2021-04575 Code injection in SAP Commerce CVSS 3.1CRITICAL 9.9
- TI-2021-09054 Code injection in SAP Commerce CVSS 3.1CRITICAL 9.9
- TI-2020-05120 Hard-coded credentials in SAP Commerce CVSS 3.1CRITICAL 9.8
- TI-2021-18574 SQL injection in SAP Commerce CVSS 3.1CRITICAL 9.8
- TI-2022-19716 Open redirect in SAP Commerce CVSS 3.1HIGH 8.8
- TI-2020-05154 Session fixation in SAP Commerce CVSS 3.1HIGH 8.1
Sources
- CVE-2021-40502 · CVE Program
- CVE-2021-40502 · NVD
- FIRST EPSS
- GHSA-grp2-x34r-x38c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences