CVE-2019-0344

Warnung

EPSS 7.08%
Veröffentlicht 14.08.2019 14:15:16
Zuletzt bearbeitet 31.10.2025 22:05:32
Erkennungen
Login

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 1 Referenzen 6

NVD 7 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

SAP ≫ Commerce Cloud Version 6.4

SAP ≫ Commerce Cloud Version 6.5

SAP ≫ Commerce Cloud Version 6.6

SAP ≫ Commerce Cloud Version 6.7

SAP ≫ Commerce Cloud Version 1808

SAP ≫ Commerce Cloud Version 1811

SAP ≫ Commerce Cloud Version 1905

30.09.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Schwachstelle

SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	7.08%	0.934

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
CISA-ADP	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H