← Back

CVE-2019-0344

nvd nist
Published: Aug 14, 2019Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Affected (7)

Products: Sap: Commerce Cloud
Sap
1 product
Commerce Cloud
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Sap
Commerce Cloud
Version 1808
Commerce Cloud
Version 1811
Commerce Cloud
Version 1905
Commerce Cloud
Version 6.4
Commerce Cloud
Version 6.5
Commerce Cloud
Version 6.6
Commerce Cloud
Version 6.7

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (5)

Source: cna@sap.com
Permissions RequiredVendor Advisory
Source: cna@sap.com
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions RequiredVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.