Description (CNA)
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SAP SE / SAP Commerce (Backoffice Search) | affected < 1808; affected < 1811; affected < 1905; affected < 2005; affected < 2011 |
CWE
No CWE identifiers supplied.
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655
- https://launchpad.support.sap.com/#/notes/3039818
ADP enrichment
No English description supplied.