CVE-2019-0344

SAP SE SAP Commerce Cloud (virtualjdbc extension), sap commerce_cloud

Published 14 Aug 2019 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 30 Sept 2024, with a remediation deadline of 21 Oct 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

References

launchpad.support.sap.com/#/notes/2786035 · Permissions Required, Vendor Advisory
wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 · Broken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344 · US Government Resource