Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
SAP Commerce跨站脚本漏洞
Vulnerability Description
SAP Commerce是德国思爱普（SAP）公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce Webservices 2.0若干版本存在跨站脚本漏洞，该漏洞源于其缺乏适当的输入验证允许攻击者通过恶意输入实现DOM型跨站脚本。攻击者可能能够窃取用户令牌并实现完整的帐户接管，包括访问SAP Commerce中的管理工具。以下版本受到影响：1905版本、2005版本、2105版本、2011版本、2205。
CVSS Information
N/A
Vulnerability Type
N/A