« Volver al listado

CVE-2019-0343

Estado: ModificadaAlta (8.8)—

SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Commerce Cloud

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0343",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Commerce Cloud (Mediaconversion Extension)",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.4"
            },
            {
              "status": "affected",
              "version": "< 6.5"
            },
            {
              "status": "affected",
              "version": "< 6.6"
            },
            {
              "status": "affected",
              "version": "< 6.7"
            },
            {
              "status": "affected",
              "version": "< 1808"
            },
            {
              "status": "affected",
              "version": "< 1811"
            },
            {
              "status": "affected",
              "version": "< 1905"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-14T14:15:16.403",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2786035",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2786035",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application."
    },
    {
      "lang": "es",
      "value": "SAP Commerce Cloud (Mediaconversion Extension), versiones 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, permite a un usuario autenticado de Backoffice/HMC inyectar código que puede ser ejecutado por la aplicación, conllevando a la Inyección de Código. De este modo, un atacante podría controlar el comportamiento de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T02:08:12.387",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E1C7951-7EDB-4BFC-ABF2-906778CD058F"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9D2F233-16BB-4E4F-8FA3-FB03A0C198E5"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB45CC6E-1837-4B0A-9F78-730161506D6D"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F32D694A-18E7-40E3-8EE0-9A240DED7A34"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5649AB0A-1D84-4716-A178-F196A1DA9C1A"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9DE60D1-95FF-4220-AE63-2C351781FDA1"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19E11B22-F514-48D6-B78F-8A64CE1BA364"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}