CVE-2021-40502

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-10 · updated 2026-06-17
Weakness: CWE-862

Description

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.

Affected products

SAP SE SAP Commerce: 1905.34, 2005.18, 2011.13, 2105.3

References

https://launchpad.support.sap.com/#/notes/3110328
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864
https://launchpad.support.sap.com/#/notes/3110328
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864

Get alerted when CVE-2021-40502 or the next vulnerability affects your stack