CVE-2019-0344

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
SAP SE	SAP Commerce Cloud (virtualjdbc extension)	< 6.4; < 6.5; < 6.6; < 6.7; < 1808; < 1811; < 1905
sap	commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7
sap	commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7
sap	commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7
sap	commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7
sap	commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7
sap	commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7
sap	commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7

References

https://launchpad.support.sap.com/#/notes/2786035Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017Broken Link
https://launchpad.support.sap.com/#/notes/2786035Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344US Government Resource

Timeline

Published: Aug 14, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Sep 30, 2024
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-03459.8A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), vers CVE-2019-03466.5Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to d CVE-2019-03486.5SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, e CVE-2019-03497.2SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT,CVE-2019-03507.5SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver CVE-2019-03518.8A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.CVE-2019-03527.5In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which le CVE-2019-03533.3Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access informati CVE-2019-03557.2SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before v CVE-2019-03564.3Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) all CVE-2019-03576.7The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privil CVE-2019-03616.1SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently