CVE-2019-0344 SAP Commerce Cloud Deserialization of Untrusted Data
Unsafe deserialization in SAP Commerce Cloud allows attackers to execute arbitrary code on the target machine.
- Exploited in the wild
- Since 30 Sep 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-0344?
CVE-2019-0344 is a critical unsafe deserialization vulnerability in SAP Commerce Cloud (virtualjdbc extension), published on 14 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Weakness: CWE-502
Which versions are affected by CVE-2019-0344?
It affects 1 product.
Products include Sap Commerce Cloud.
How do I fix CVE-2019-0344?
No fix has been published for CVE-2019-0344 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Oct 2024.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-0344 being exploited?
Yes. Attackers have exploited CVE-2019-0344 in the wild since at least 30 Sep 2024.
Other vulnerabilities in SAP Commerce Cloud (virtualjdbc extension)
- CVE-2020-6238 XML external entity in SAP Commerce
- CVE-2023-39439 SAP Commerce accepts empty passphrases.
- CVE-2019-0343 Code injection in SAP Commerce Cloud (Mediaconversion Extension)
- CVE-2023-42481 Improper Access Control vulnerability in SAP Commerce Cloud
- CVE-2019-0322 Denial of service in SAP Commerce Cloud (ex SAP Hybris Commerce) (HY COM)
Sources
Also known as GHSA-75jg-chc9-wv8p.