CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Published Aug 14, 2019 · updated Jun 16, 2026 · sap commerce cloud
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Timeline
Detection, updates, and resolution for this record.
Aug 14, 2019 · Catalog
Detected
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Sep 30, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Oct 21, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Oct 21, 2024
Affected
- cpe sap/commerce cloud1808
- cpe sap/commerce cloud1811
- cpe sap/commerce cloud1905
- cpe sap/commerce cloud6.4
- cpe sap/commerce cloud6.5
- cpe sap/commerce cloud6.6
- cpe sap/commerce cloud6.7
- vendor SAP Commerce Cloudversion unspecified
Sources
- CISA KEVCVE-2019-0344
SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
cisa.gov - CVE.orgCVE-2019-0344
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-0344
30-day exploitation probability 7.1%
first.org - NIST NVDCVE-2019-0344
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
nvd.nist.gov