CVE-2019-0344

CVE Published	2019-08-14
Related CWE(s)	CWE-502: Deserialization of Untrusted Data
Related Vendor(s)	sap
Related Product(s)	commerce_cloud
Exploitation Reported (CISA KEV)	2024-09-30
CVSS 3 Base Score	9.8 (CRITICAL)
CVSS 3 Attack Complexity	LOW
CVSS 3 Attack Vector	NETWORK

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Cyber Threat Graph Context

Explore how this CVE relates to the wider threat graph

Associated CAPEC Patterns

Object Injection (CAPEC-586)

An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.

References

CVE-2019-0344

Cyber Threat Graph Context

Associated CAPEC Patterns

Object Injection (CAPEC-586)

References

CVE.org

NIST National Vulnerability Database

CISA Known Exploited Vulnerabilities