CVE-2019-0308: XSS
First published: Wed Jun 12 2019(Updated: )
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP E-Commerce | =7.30 | |
| SAP E-Commerce | =7.31 | |
| SAP E-Commerce | =7.32 | |
| SAP E-Commerce | =7.33 | |
| SAP E-Commerce | =7.54 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap e-commerce
- version/sap e-commerce/7.30
- version/sap e-commerce/7.31
- version/sap e-commerce/7.32
- version/sap e-commerce/7.33
- version/sap e-commerce/7.54