CVE-2019-0238 - SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability

Back Back to CVE browser

MEDIUM

SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability

Published Jan 8, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 1.02%

Description

SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected products

Vendor SAP SE Product SAP Commerce (ex. SAP Hybris Commerce) Default
n/a
- Version
  < 6.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Commerce (ex. SAP Hybris Commerce)

n/a

Version	Status	Constraints
< 6.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

http://www.securityfocus.com/bid/106462
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2697573
x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985
x_refsource_MISCVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/106462		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://launchpad.support.sap.com/#/notes/2697573		x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Jan 8, 2019

Updated Aug 4, 2024

Reserved Nov 26, 2018

Link CVE-2019-0238

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-0238

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-0238