SAP · Commerce Cloud

CVE-2019-0344

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 7.5%

What it is

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

CISA: SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: October 21, 2024

Added to the CISA list: September 30, 2024
Published: August 14, 2019
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 7.5% in the top 5.6% of all known vulnerabilities
Weakness: CWE-502
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from SAP

Added	Vulnerability	Product	Severity	Attack chance
May 15, 2025	DeserializationCVE-2025-42999used by ransomware	NetWeaver	Critical 9.1	13%
Apr 29, 2025	Unrestricted File UploadCVE-2025-31324used by ransomware	NetWeaver	Critical 10.0	99.5%
Mar 19, 2025	Directory TraversalCVE-2017-12637	NetWeaver	High 7.5	95%
Aug 18, 2022	HTTP Request SmugglingCVE-2022-22536	Multiple Products	Critical 9.8	98%
Jun 9, 2022	SQL InjectionCVE-2016-2386	NetWeaver	Critical 9.8	72%
Jun 9, 2022	Information DisclosureCVE-2016-2388	NetWeaver	Medium 5.3	52%
Jun 9, 2022	Unrestricted File UploadCVE-2021-38163	NetWeaver	Critical 9.9	37%
Nov 3, 2021	Remote Code ExecutionCVE-2010-5326	NetWeaver	Critical 10.0	18%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.