CVE-2019-0344

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

SAP — Commerce Cloud

Added to KEV catalog: 30 September 2024
Federal remediation due date: 21 October 2024
Weakness classification (CWE): CWE-502

CISA Description

SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://web.archive.org/web/20191214053020/https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 ; https://nvd.nist.gov/vuln/detail/CVE-2019-0344

View on NVD View on MITRE CVE View full CISA catalog

More SAP Vulnerabilities

CVE-2025-42999

SAP NetWeaver Deserialization Vulnerability

CVE-2025-31324

SAP NetWeaver Unrestricted File Upload Vulnerability

CVE-2017-12637

SAP NetWeaver Directory Traversal Vulnerability

CVE-2022-22536

SAP Multiple Products HTTP Request Smuggling Vulnerability

CVE-2021-38163

SAP NetWeaver Unrestricted File Upload Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services