XSS in SAP E-Commerce
CVE-2019-0308
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.009 (54.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N.
Affected products
- Sap E-commerce — versions 7.30, 7.31, 7.32
- Sap Se E-commerce (Business-to-consumer Application) — versions < 7.3, < 7.31, < 7.32
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-0308?
- CVE-2019-0308 is a medium-severity vulnerability in SAP E-Commerce, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2019-06-12.
- How severe is CVE-2019-0308?
- Medium severity. CVSS v3 base score is 6.8 out of 10.