Commerce Cloud vulnerabilitiesAnd the versions its exploited flaws hit.
Commerce Cloud is made by SAP. We track 16 published vulnerabilities listed under that exact name, across 17 versions. 1 of them is on the list of flaws known to be exploited, the newest added on 30 September 2024. SAP lists newer releases under their own names, such as Commerce Cloud (accelerator Payment Mock), so check those pages too.
The most recent Commerce Cloud flaw added to the known-exploited list is CVE-2019-0344, on 30 September 2024. We keep watching the known-exploited list.
Is Commerce Cloud listed under other names? Yes.
SAP also lists Commerce Cloud under more specific names, such as Commerce Cloud (accelerator Payment Mock). Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which versions of Commerce Cloud do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2019-0344Exploited list, 30 Sep 2024
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
6.46.56.66.7180818111905
Which Commerce Cloud vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
Which Commerce Cloud flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 7.1%
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights,...
- 2.6%CVE-2019-0322High
SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or...
- 2.1%CVE-2020-26809Medium
SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders.
- 1.5%CVE-2019-0343High
SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection.
- 1.3%CVE-2020-6238Critical
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation.
- 0.8%CVE-2020-6232Medium
SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check.
- 0.8%CVE-2020-6201Medium
The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without...
- 0.7%CVE-2023-39439Critical
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
- 0.6%CVE-2021-21445Medium
SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user.
- 0.5%CVE-2021-33666Medium
When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation.
Running Commerce Cloud? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
- Matched to
- Commerce Cloud on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 16 published vulnerabilities listed under the name Commerce Cloud, across 17 versions. The most recent Commerce Cloud flaw added to the known-exploited list is CVE-2019-0344, on 30 September 2024.
1 is on the list of flaws known to be exploited. The most recently added is CVE-2019-0344.
SAP also lists Commerce Cloud under more specific names, such as Commerce Cloud (accelerator Payment Mock). Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2019-0344, affects 6.4, 6.5, 6.6, 6.7 and more. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Commerce Cloud. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.