« Volver al listado

CVE-2019-0308

Estado: ModificadaMedia (6.8)—

An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — E-commerce

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0308",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP E-Commerce (Business-to-Consumer application)",
          "versions": [
            {
              "status": "affected",
              "version": "< 7.3"
            },
            {
              "status": "affected",
              "version": "< 7.31"
            },
            {
              "status": "affected",
              "version": "< 7.32"
            },
            {
              "status": "affected",
              "version": "< 7.33"
            },
            {
              "status": "affected",
              "version": "< 7.54"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-12T15:29:00.427",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2773493",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2773493",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection."
    },
    {
      "lang": "es",
      "value": "Un atacante identificado en SAP E-Commerce (Business-to-Consumer application) versiones 7.3, 7.31, 7.32, 7.33, 7.54 pueden cambiar el precio del producto a cero y además pagar inyectando un código HTML en la aplicación que será ejecutada en cualquier lugar que está la víctima se conecte en la aplicación o incluso en una máquina diferente, lo que conlleva a un código de inyección"
    }
  ],
  "lastModified": "2026-06-17T02:08:09.507",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:e-commerce:7.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE94DFE3-E312-488B-918E-1CEB70C0BD69"
            },
            {
              "criteria": "cpe:2.3:a:sap:e-commerce:7.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACE05D58-D4D8-49AA-951A-DF226EA70ADD"
            },
            {
              "criteria": "cpe:2.3:a:sap:e-commerce:7.32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A24300CE-8C2E-446A-BF40-712C38DDE0F7"
            },
            {
              "criteria": "cpe:2.3:a:sap:e-commerce:7.33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "729FFC5E-4A45-4B9A-A4B0-A9CAEFBD2BF0"
            },
            {
              "criteria": "cpe:2.3:a:sap:e-commerce:7.54:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E3A8F76-F6EA-47DC-A08B-645CC044A917"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}