← Back to browse · API

CVE-2019-0344

Severity
CRITICAL
CVSS
9.8
EPSS
0.07079
Risk score
66.68
CISA KEV
Yes
PoC
No
Published
2019-08-14
Modified
2025-10-21
First seen
2026-08-07
Aliases
EUVD-2019-1117, GHSA-75JG-CHC9-WV8P
Products
SAP SE:SAP Commerce Cloud (virtualjdbc extension) < 1808, SAP SE:SAP Commerce Cloud (virtualjdbc extension) < 1811, SAP SE:SAP Commerce Cloud (virtualjdbc extension) < 1905, SAP SE:SAP Commerce Cloud (virtualjdbc extension) < 6.4, SAP SE:SAP Commerce Cloud (virtualjdbc extension) < 6.5, SAP SE:SAP Commerce Cloud (virtualjdbc extension) < 6.6, SAP SE:SAP Commerce Cloud (virtualjdbc extension) < 6.7, SAP:Commerce Cloud
Sources
cisa.gov CVE-2019-0344
euvd EUVD-2019-1117

Description

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

References