CVE-2019-0308

{"containers": {"cna": {"affected": [{"product": "SAP E-Commerce (Business-to-Consumer application)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 7.3"}, {"status": "affected", "version": "< 7.31"}, {"status": "affected", "version": "< 7.32"}, {"status": "affected", "version": "< 7.33"}, {"status": "affected", "version": "< 7.54"}]}], "descriptions": [{"lang": "en", "value": "An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection."}], "problemTypes": [{"descriptions": [{"description": "Code Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-12T16:11:08.000Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/2773493"}, {"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2019-0308", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP E-Commerce (Business-to-Consumer application)", "version": {"version_data": [{"version_name": "<", "version_value": "7.3"}, {"version_name": "<", "version_value": "7.31"}, {"version_name": "<", "version_value": "7.32"}, {"version_name": "<", "version_value": "7.33"}, {"version_name": "<", "version_value": "7.54"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Code Injection"}]}]}, "references": {"reference_data": [{"name": "https://launchpad.support.sap.com/#/notes/2773493", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/2773493"}, {"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:44:16.439Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/2773493"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"}]}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2019-0308", "datePublished": "2019-06-12T14:21:39.000Z", "dateReserved": "2018-11-26T00:00:00.000Z", "dateUpdated": "2024-08-04T17:44:16.439Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "SAP E-Commerce (Business-to-Consumer application)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 7.3"}, {"status": "affected", "version": "< 7.31"}, {"status": "affected", "version": "< 7.32"}, {"status": "affected", "version": "< 7.33"}, {"status": "affected", "version": "< 7.54"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:e-commerce:7.30:*:*:*:*:*:*:*", "matchCriteriaId": "AE94DFE3-E312-488B-918E-1CEB70C0BD69", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:e-commerce:7.31:*:*:*:*:*:*:*", "matchCriteriaId": "ACE05D58-D4D8-49AA-951A-DF226EA70ADD", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:e-commerce:7.32:*:*:*:*:*:*:*", "matchCriteriaId": "A24300CE-8C2E-446A-BF40-712C38DDE0F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:e-commerce:7.33:*:*:*:*:*:*:*", "matchCriteriaId": "729FFC5E-4A45-4B9A-A4B0-A9CAEFBD2BF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:e-commerce:7.54:*:*:*:*:*:*:*", "matchCriteriaId": "2E3A8F76-F6EA-47DC-A08B-645CC044A917", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection."}, {"lang": "es", "value": "Un atacante identificado en SAP E-Commerce (Business-to-Consumer application) versiones 7.3, 7.31, 7.32, 7.33, 7.54 pueden cambiar el precio del producto a cero y adem\u00e1s pagar inyectando un c\u00f3digo HTML en la aplicaci\u00f3n que ser\u00e1 ejecutada en cualquier lugar que est\u00e1 la v\u00edctima se conecte en la aplicaci\u00f3n o incluso en una m\u00e1quina diferente, lo que conlleva a un c\u00f3digo de inyecci\u00f3n"}], "id": "CVE-2019-0308", "lastModified": "2026-06-17T02:08:09.507", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-06-12T15:29:00.427", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2773493"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2773493"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}