CVE-2019-0308
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2019
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
SAP E-Commerce (Business-to-Consumer application)
- Vendor
- SAP SE
- Product
- SAP E-Commerce (Business-to-Consumer application)
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| < 7.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| < 7.31 | affected | Unavailable | Unavailable | Unavailable | None listed |
| < 7.32 | affected | Unavailable | Unavailable | Unavailable | None listed |
| < 7.33 | affected | Unavailable | Unavailable | Unavailable | None listed |
| < 7.54 | affected | Unavailable | Unavailable | Unavailable | None listed |