Code injection in SAP Commerce Cloud
Priority MEDIUM 41CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
Why it matters now
EPSS 0.01482 74th percentileScored 2026-11-07
Fix Fixed SAP Commerce Cloud (Mediaconversion Extension) (SAP SE): 6.4, 6.5, 6.6 +4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Commerce Cloud (Mediaconversion Extension) | before 6.4; before 6.5; before 6.6; before 6.7; before 1808; before 1811; before 1905 | 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905 | Patch available | CNA |
- SAP Commerce Cloud (Mediaconversion Extension) VendorSAP Affected before 6.4; before 6.5; before 6.6; before 6.7; before 1808; before 1811; before 1905 Fixed in 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:* | 6.5 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:* | 6.6 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:* | 6.7 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:* | 1808 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:* | 1811 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:* | 1905 | Vulnerable | SAP |
- cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:* Versions 6.5 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:* Versions 6.6 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:* Versions 1808 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:* Versions 1811 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:* Versions 1905 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Commerce Cloud (Mediaconversion Extension) (SAP SE) Fixed in 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0343
- 2026-10-03 Alias added: GHSA-9wr2-hqp2-7rf5
References
More SAP Commerce Cloud vulnerabilities
- TI-2019-00284 Deserialization of untrusted data in SAP Commerce Cloud KEVCVSS 3.1CRITICAL 9.8
- TI-2023-20575 SAP Commerce accepts empty passphrases. CVSS 3.1CRITICAL 9.8
- TI-2020-05094 XML external entity injection in SAP Commerce CVSS 3.1CRITICAL 9.3
- TI-2024-21868 Information Disclosure Vulnerability in SAP Commerce Cloud CVSS 3.1CRITICAL 9.1
- TI-2019-00267 SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4… CVSS 3.0HIGH 7.5
- TI-2023-22645 Improper Access Control vulnerability in SAP Commerce Cloud CVSS 3.1HIGH 8.1
Sources
- CVE-2019-0343 · CVE Program
- CVE-2019-0343 · NVD
- FIRST EPSS
- GHSA-9wr2-hqp2-7rf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences