SAP E-Commerce vulnerabilities

2 CVEs affecting SAP E-Commerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-0308, published 2019-06-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0298, published 2019-05-14. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components…
CVE-2019-0308, published 2019-06-12. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an…