Live › vulnerability › CVE-2019-0344
Go to dashboardSAP Commerce Cloud (formerly Hybris) has a deserialization flaw in its mediaconversion and virtualjdbc extensions. An attacker who can send crafted serialized data can inject code that runs on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SAP Commerce Cloud | vendor | – | – |
| sap commerce cloud | vendor | = 6.4 | – |
| sap commerce cloud | vendor | = 6.5 | – |
| sap commerce cloud | vendor | = 6.6 | – |
| sap commerce cloud | vendor | = 6.7 | – |
| sap commerce cloud | vendor | = 1808 | – |
| sap commerce cloud | vendor | = 1811 | – |
| sap commerce cloud | vendor | = 1905 | – |
Unknown from the sources.
Apply the mitigations from the vendor (SAP) instructions, or stop using the affected product if no mitigation is available.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2019-0344")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.