Actively exploited · Published Aug 14, 2019 · Assigned by sap
CVE-2019-0344
Critical 9.8 Exploited
In plain English
A critical-severity unsafe deserialization in SAP Commerce Cloud (virtualjdbc extension) from SAP SE. Attackers are actively exploiting it in the wild (listed by CISA on September 30, 2024). The chance it is exploited in the next 30 days is estimated at 7.5% (higher than 94% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 21, 2024.
Official description
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Commerce Cloud (virtualjdbc extension) | < 6.4< 6.5< 6.6< 6.7< 1808< 1811< 1905 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2786035 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344 government-resource