← CVE Radar
CVE-2019-0344SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
9.8 CRITICALEPSS 7.46%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 7.5 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Oct 21, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2019-0344
- Status
- Analyzed
- Assigner (CNA)
- sap
- Published
- Aug 14, 2019
- Last modified
- 2026-06-17 02:08 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
SAP SESAP Commerce Cloud (virtualjdbc extension)7 version ranges
- < 6.4
- < 6.5
- < 6.6
- < 6.7
- < 1808
- < 1811
- < 1905