CVE-2019-0308

Severity: medium (CVSS 6.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-12 · updated 2026-06-17
Weakness: CWE-79

Description

An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.

Affected products

SAP SE SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP): 7.30, 7.31, 7.32, 7.33, 7.54

References

https://launchpad.support.sap.com/#/notes/2773493
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
https://launchpad.support.sap.com/#/notes/2773493
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242

Get alerted when CVE-2019-0308 or the next vulnerability affects your stack