CVE-2019-0344

CRITICALCISA KEV

9.8

Description

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie8/14/2019

Derniere modification10/31/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurSAP

ProduitCommerce Cloud

Nom vulnerabiliteSAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Date ajout KEV2024-09-30

Date limite remediation2024-10-21

Utilise dans ransomwareUnknown

Produits affectes

sap:commerce_cloud

Faiblesses (CWE)

CWE-502CWE-502

References

https://launchpad.support.sap.com/#/notes/2786035(cna@sap.com)

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017(cna@sap.com)

https://launchpad.support.sap.com/#/notes/2786035(af854a3a-2127-422b-91ae-364da2661108)

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.