CVE-2019-0344criticalunder attackCWE-502

CVE-2019-0344: critical vulnerability in SAP Commerce Cloud (virtualjdbc extension)

Published · Updated

Follow this CVE+ Monitor SAP Commerce Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 7.5%
from disclosure to weapon
Published on NVDAug 14
CISA KEV+1874d
Action required by CISAfederal deadline: 2024-10-21

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

SAP Commerce Cloud's virtualjdbc extension unsafely processes untrusted data, allowing attackers to run malicious code on the server. This is a critical flaw because it gives attackers full control over the system with application-level privileges.

Technical detail

The virtualjdbc extension in SAP Commerce Cloud (versions 6.4–1905) deserializes untrusted input without proper validation, enabling remote code execution under the Hybris application user context. An attacker can inject arbitrary code by crafting malicious serialized objects, bypassing authentication if the deserialization endpoint is exposed.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SAP SE · SAP Commerce Cloud (virtualjdbc extension)