September 30, 2024 · Applied Cybernetics Group
CVE-2019-0344 — SAP Commerce Cloud
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
- Added to KEV
2024-09-30- Federal due date
2024-10-21- Vendor
- SAP
- Product
- Commerce Cloud
- EPSS
- 93.5th percentile (score 0.071, as of
2026-07-13) - NVD CVSS v3.1
- —
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2019-0344
CISA short description
SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.