critical9.8Known exploited
CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-09-30. Federal due date: 2024-10-21.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Commerce Cloud | Versions 6.4, 6.5, 6.6, 6.7, 1808, 1811 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://launchpad.support.sap.com/#/notes/2786035
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
- https://launchpad.support.sap.com/#/notes/2786035
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344