CVE-2019-0344

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 7,1%

Kerentanan Deserialization of Untrusted Data pada sap commerce cloud. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 30 September 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Rincian

Terbit di NVD

14 Agustus 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

7,1% peluang dieksploitasi; lebih tinggi dari 94,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Masuk KEV

30 September 2024

Tenggat CISA

21 Oktober 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://launchpad.support.sap.com/#/notes/2786035 permissions required · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344 pemerintah AS
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 broken link