CVE-2019-0344

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

Act

*SSVC

Descriptions

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Debido a una deserialización no confiable usada en SAP Commerce Cloud (virtualjdbc extension), versiones 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, es posible ejecutar código arbitrario en una máquina de destino con derechos de usuario 'Hybris', resultando en Inyección de Código.

SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:Act

Exploitation

Active

Automatable

Yes

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2018-11-26 CVE Reserved
2019-08-14 CVE Published
2024-09-30 Exploited in Wild
2024-10-04 CVE Updated
2024-10-08 EPSS Updated
2024-10-21 KEV Due Date
---------- First Exploit

CWE

CWE-502: Deserialization of Untrusted Data

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017	2020-08-24

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sap Search vendor "Sap"		Commerce Cloud Search vendor "Sap" for product "Commerce Cloud"				6.4 Search vendor "Sap" for product "Commerce Cloud" and version "6.4"		-		Affected
Sap Search vendor "Sap"		Commerce Cloud Search vendor "Sap" for product "Commerce Cloud"				6.5 Search vendor "Sap" for product "Commerce Cloud" and version "6.5"		-		Affected
Sap Search vendor "Sap"		Commerce Cloud Search vendor "Sap" for product "Commerce Cloud"				6.6 Search vendor "Sap" for product "Commerce Cloud" and version "6.6"		-		Affected
Sap Search vendor "Sap"		Commerce Cloud Search vendor "Sap" for product "Commerce Cloud"				6.7 Search vendor "Sap" for product "Commerce Cloud" and version "6.7"		-		Affected
Sap Search vendor "Sap"		Commerce Cloud Search vendor "Sap" for product "Commerce Cloud"				1808 Search vendor "Sap" for product "Commerce Cloud" and version "1808"		-		Affected
Sap Search vendor "Sap"		Commerce Cloud Search vendor "Sap" for product "Commerce Cloud"				1811 Search vendor "Sap" for product "Commerce Cloud" and version "1811"		-		Affected
Sap Search vendor "Sap"		Commerce Cloud Search vendor "Sap" for product "Commerce Cloud"				1905 Search vendor "Sap" for product "Commerce Cloud" and version "1905"		-		Affected