What is the severity of CVE-2021-42064?

CVE-2021-42064 is considered a critical vulnerability due to the potential for attackers to execute arbitrary database queries.

How do I fix CVE-2021-42064?

To mitigate CVE-2021-42064, upgrade your SAP Commerce installation to the latest patched version provided by SAP.

What versions of SAP Commerce are affected by CVE-2021-42064?

CVE-2021-42064 affects SAP Commerce versions 1905, 2005, 2011, and 2105.

What type of attack can be executed through CVE-2021-42064?

CVE-2021-42064 allows attackers to execute crafted database queries, exposing sensitive backend data.

Is there a workaround for CVE-2021-42064?

As of now, the best approach for CVE-2021-42064 is applying the security patch from SAP, as no official workarounds exist.

Vulnerability/
CVE-2021-42064

critical

9.8

CWE

14/12/2021

21/11/2024

CVE-2021-42064: SQL Injection

First published: Tue Dec 14 2021(Updated: )

If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.

Credit: cna@sap.com cna@sap.com

Affected Software	Affected Version	How to fix
SAP Commerce	=1905
SAP Commerce	=2005
SAP Commerce	=2011
SAP Commerce	=2105
	=1905
	=2005
	=2011
	=2105

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2021-42064?
CVE-2021-42064 is considered a critical vulnerability due to the potential for attackers to execute arbitrary database queries.
How do I fix CVE-2021-42064?
To mitigate CVE-2021-42064, upgrade your SAP Commerce installation to the latest patched version provided by SAP.
What versions of SAP Commerce are affected by CVE-2021-42064?
CVE-2021-42064 affects SAP Commerce versions 1905, 2005, 2011, and 2105.
What type of attack can be executed through CVE-2021-42064?
CVE-2021-42064 allows attackers to execute crafted database queries, exposing sensitive backend data.
Is there a workaround for CVE-2021-42064?
As of now, the best approach for CVE-2021-42064 is applying the security patch from SAP, as no official workarounds exist.

collector/nvd-index
agent/references
agent/type
collector/mitre-cve
source/MITRE
agent/severity
agent/weakness
agent/first-publish-date
agent/description
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/last-modified-date
agent/author
agent/softwarecombine
agent/event
agent/tags
agent/source
vendor/sap
canonical/sap commerce
version/sap commerce/1905
version/sap commerce/2005
version/sap commerce/2011
version/sap commerce/2105

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.