PT-2019-4195 · Sap · Sap Commerce Cloud

Publicado 2019-08-13 · Atualizado 2019-08-23 · CVE-2019-0343

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud (Mediaconversion Extension) versions 6.4 through 6.7, 1808, 1811, 1905

Description The issue is related to errors in code generation management in the Mediaconversion component of the SAP Commerce Cloud e-commerce platform. It allows a remote attacker to potentially gain full control over the application. Specifically, an authenticated Backoffice/HMC user can inject code that can be executed by the application, leading to code injection. This enables an attacker to control the behavior of the application.

Recommendations For SAP Commerce Cloud (Mediaconversion Extension) versions 6.4 through 6.7, 1808, 1811, 1905, consider restricting access to the Mediaconversion component until a fix is available. As a temporary workaround, limit the privileges of authenticated Backoffice/HMC users to minimize the risk of code injection. Avoid using the Mediaconversion Extension in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2019-04791

CVE-2019-0343

Produtos afetados

Sap Commerce Cloud

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0343 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-0343 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-0343 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04791 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2786035 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 · Aviso do Fabricante