CVE-2021-27619
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. …
Published: 2021-05-11 · CVSS: 6.5 · CVSS 3.0
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7