CVE-2021-42064

If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.

CVSS v3 9.8 CRITICAL
CVSS v2.0 6.8 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3114134	Permissions Required
https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021	Vendor Advisory
https://launchpad.support.sap.com/#/notes/3114134	Permissions Required
https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:commerce:1905:::::::*
	cpe:2.3:a:sap:commerce:2005:::::::*
	cpe:2.3:a:sap:commerce:2011:::::::*
	cpe:2.3:a:sap:commerce:2105:::::::*

History

21 Nov 2024, 06:27

Type	Values Removed	Values Added
References	~~() https://launchpad.support.sap.com/#/notes/3114134 - Permissions Required~~	() https://launchpad.support.sap.com/#/notes/3114134 - Permissions Required
References	~~() https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021 - Vendor Advisory~~	() https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021 - Vendor Advisory

Information

Published : 2021-12-14 16:15

Updated : 2024-11-21 06:27

NVD link : CVE-2021-42064

Mitre link : CVE-2021-42064

CVE.ORG link : CVE-2021-42064

JSON object : View

Products Affected

sap

commerce

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2021-42064", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-12-14T16:15:09.303", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3114134", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/3114134", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized \"in\" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized \"in\" clause accepts more than 1000 values."}, {"lang": "es", "value": "Si es configurado para usar una base de datos Oracle y si se crea una consulta usando la api java de b\u00fasqueda flexible con una cl\u00e1usula \"in\" parametrizada, SAP Commerce - versiones 1905, 2005, 2105, 2011, permite al atacante ejecutar consultas de base de datos dise\u00f1adas, exponiendo la base de datos del backend. La vulnerabilidad est\u00e1 presente si la cl\u00e1usula \"in\" parametrizada acepta m\u00e1s de 1000 valores"}], "lastModified": "2024-11-21T06:27:10.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F665F648-5C35-4EC8-8064-8ED139C8813C"}, {"criteria": "cpe:2.3:a:sap:commerce:2005:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C788164A-7724-4CB1-8ADC-B05ADE595020"}, {"criteria": "cpe:2.3:a:sap:commerce:2011:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DE31C0C-31D7-468E-B1D4-CE522086EDD3"}, {"criteria": "cpe:2.3:a:sap:commerce:2105:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BF52269-A749-4A58-A291-ACD4C41C6FAF"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}