CVE Feed

    Dashboard / CVE / CVE-2022-41266

    CVE-2022-41266

    Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack.  As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.

    Published:Dec 13, 2022
    Last Modified:Apr 22, 2025
    EPS:Dec 13, 2022
    EPSS Score:0.00281
    CVSS Score:8

    Affected Products

    Vendor
    Sap
    Product
    Commerce Webservices 2.0

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High