description: An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.
problem types: CWE-601
affected:
{
vendor: SAP SE
product: SAP Commerce
versions:
version: 1905, status: affected
version: 2005, status: affected
version: 2105, status: affected
version: 2011, status: affected
version: 2205, status: affected
}