CVE-2019-0344SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Bekannt ausgenutzt — SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
CISA hat am 30.09.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 21.10.2024.
Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://web.archive.org/web/20191214053020/https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 ; https://nvd.nist.gov/vuln/detail/CVE-2019-0344
Beschreibung
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| sap | commerce_cloud | 1808, 1811, 1905, 6.4, 6.5, 6.6, 6.7 | |
| SAP SE | SAP Commerce Cloud (virtualjdbc extension) | < 6.4, < 6.5, < 6.6, < 6.7, < 1808, < 1811, < 1905 |
Referenzen und Patches
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 Broken Link
- https://launchpad.support.sap.com/#/notes/2786035 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344 US Government Resource
CPE-Treffer (NVD) (7)
cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:*cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:*cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:*cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*