CVE-2019-0344

SAP Commerce Cloud's virtualjdbc extension unsafely processes untrusted data, allowing attackers to run malicious code on the server. This is a critical flaw because it gives attackers full control over the system with application-level privileges.

The virtualjdbc extension in SAP Commerce Cloud (versions 6.4–1905) deserializes untrusted input without proper validation, enabling remote code execution under the Hybris application user context. An attacker can inject arbitrary code by crafting malicious serialized objects, bypassing authentication if the deserialization endpoint is exposed.