{"containers": {"cna": {"affected": [{"product": "SAP Commerce Cloud (virtualjdbc extension)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 6.4"}, {"status": "affected", "version": "< 6.5"}, {"status": "affected", "version": "< 6.6"}, {"status": "affected", "version": "< 6.7"}, {"status": "affected", "version": "< 1808"}, {"status": "affected", "version": "< 1811"}, {"status": "affected", "version": "< 1905"}]}], "descriptions": [{"lang": "en", "value": "Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection."}], "problemTypes": [{"descriptions": [{"description": "Code Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-08-14T13:53:21", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/2786035"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2019-0344", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP Commerce Cloud (virtualjdbc extension)", "version": {"version_data": [{"version_name": "<", "version_value": "6.4"}, {"version_name": "<", "version_value": "6.5"}, {"version_name": "<", "version_value": "6.6"}, {"version_name": "<", "version_value": "6.7"}, {"version_name": "<", "version_value": "1808"}, {"version_name": "<", "version_value": "1811"}, {"version_name": "<", "version_value": "1905"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Code Injection"}]}]}, "references": {"reference_data": [{"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017"}, {"name": "https://launchpad.support.sap.com/#/notes/2786035", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/2786035"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:44:16.517Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/2786035"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "affected": [{"vendor": "sap", "product": "commerce_cloud", "cpes": ["cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1808", "status": "affected"}, {"version": "1811", "status": "affected"}, {"version": "1905", "status": "affected"}, {"version": "6.4", "status": "affected"}, {"version": "6.5", "status": "affected"}, {"version": "6.6", "status": "affected"}, {"version": "6.7", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-09-30", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-04T13:32:40.662258Z", "id": "CVE-2019-0344", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T13:36:02.145Z"}}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2019-0344", "datePublished": "2019-08-14T13:53:21", "dateReserved": "2018-11-26T00:00:00", "dateUpdated": "2024-10-04T13:36:02.145Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://launchpad.support.sap.com/#/notes/2786035", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:44:16.517Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-09-30", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2019-0344", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-04T13:32:40.662258Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:*", "cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*"], "vendor": "sap", "product": "commerce_cloud", "versions": [{"status": "affected", "version": "1808"}, {"status": "affected", "version": "1811"}, {"status": "affected", "version": "1905"}, {"status": "affected", "version": "6.4"}, {"status": "affected", "version": "6.5"}, {"status": "affected", "version": "6.6"}, {"status": "affected", "version": "6.7"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T13:35:19.686Z"}}], "cna": {"affected": [{"vendor": "SAP SE", "product": "SAP Commerce Cloud (virtualjdbc extension)", "versions": [{"status": "affected", "version": "< 6.4"}, {"status": "affected", "version": "< 6.5"}, {"status": "affected", "version": "< 6.6"}, {"status": "affected", "version": "< 6.7"}, {"status": "affected", "version": "< 1808"}, {"status": "affected", "version": "< 1811"}, {"status": "affected", "version": "< 1905"}]}], "references": [{"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017", "tags": ["x_refsource_MISC"]}, {"url": "https://launchpad.support.sap.com/#/notes/2786035", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2019-08-14T13:53:21"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "<", "version_value": "6.4"}, {"version_name": "<", "version_value": "6.5"}, {"version_name": "<", "version_value": "6.6"}, {"version_name": "<", "version_value": "6.7"}, {"version_name": "<", "version_value": "1808"}, {"version_name": "<", "version_value": "1811"}, {"version_name": "<", "version_value": "1905"}]}, "product_name": "SAP Commerce Cloud (virtualjdbc extension)"}]}, "vendor_name": "SAP SE"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017", "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017", "refsource": "MISC"}, {"url": "https://launchpad.support.sap.com/#/notes/2786035", "name": "https://launchpad.support.sap.com/#/notes/2786035", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Code Injection"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-0344", "STATE": "PUBLIC", "ASSIGNER": "cna@sap.com"}}}}, "cveMetadata": {"cveId": "CVE-2019-0344", "state": "PUBLISHED", "dateUpdated": "2024-10-04T13:36:02.145Z", "dateReserved": "2018-11-26T00:00:00", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2019-08-14T13:53:21", "assignerShortName": "sap"}, "dataVersion": "5.1"}

{"cisaActionDue": "2024-10-21", "cisaExploitAdd": "2024-09-30", "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:*", "matchCriteriaId": "6E1C7951-7EDB-4BFC-ABF2-906778CD058F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:*", "matchCriteriaId": "B9D2F233-16BB-4E4F-8FA3-FB03A0C198E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:*", "matchCriteriaId": "CB45CC6E-1837-4B0A-9F78-730161506D6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*", "matchCriteriaId": "F32D694A-18E7-40E3-8EE0-9A240DED7A34", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*", "matchCriteriaId": "5649AB0A-1D84-4716-A178-F196A1DA9C1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*", "matchCriteriaId": "A9DE60D1-95FF-4220-AE63-2C351781FDA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*", "matchCriteriaId": "19E11B22-F514-48D6-B78F-8A64CE1BA364", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection."}, {"lang": "es", "value": "Debido a una deserializaci\u00f3n no confiable usada en SAP Commerce Cloud (virtualjdbc extension), versiones 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, es posible ejecutar c\u00f3digo arbitrario en una m\u00e1quina de destino con derechos de usuario 'Hybris', resultando en Inyecci\u00f3n de C\u00f3digo."}], "id": "CVE-2019-0344", "lastModified": "2025-01-27T21:44:13.570", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2019-08-14T14:15:16.463", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2786035"}, {"source": "cna@sap.com", "tags": ["Broken Link"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2786035"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}