Hybris
Vendor:
First CVE: Dec 31, 2016 · Active for 9 years
8
Total CVEs
More Total CVEs than 87% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 63% of tracked products
6.2
Avg CVSS
Higher Avg CVSS than 28% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Hybris over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2016
9 years ago
Most Recent CVE
Jan 8, 2019
2,757 days ago
CVE Severity & Scoring
Hybris8 CVEs
75%
25%
All CVEs352,785 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (37.5%)
Unknown0 (0.0%)
Required5 (62.5%)
Privileges Required
Low3 (37.5%)
High0 (0.0%)
None5 (62.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-2463HIGH The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML pars | Sep 11, 2018 | 8.6 | 27 | NO | NO |
CVE-2018-2505MEDIUM SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in ver | Dec 11, 2018 | 6.1 | 22 | NO | NO |
CVE-2019-0238MEDIUM SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabili | Jan 8, 2019 | 6.1 | 21 | NO | NO |
CVE-2014-8871HIGH Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2 and earlier, 5.2.0.3 | Aug 28, 2017 | 7.5 | 20 | NO | NO |
CVE-2016-6856MEDIUM Cross-site scripting (XSS) vulnerability in the Inbox Search feature in Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to inject arbitrary web scr | Dec 31, 2016 | 6.1 | 17 | NO | NO |
CVE-2016-6858MEDIUM Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC) in SAP Hybris before 5.0.4.11, 5.1.0.x before 5.1.0.11, 5.1.1.x before 5. | Dec 31, 2016 | 5.4 | 15 | NO | NO |
CVE-2016-6857MEDIUM Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris Management Console (HMC) in SAP Hybris before 5.2.0.13, 5.3.x before 5.3.0.11, 5.4.x before 5.4.0 | Dec 31, 2016 | 5.4 | 15 | NO | NO |
CVE-2016-6859MEDIUM Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to obtain sensitive information by triggering an error and then reading a Java stack trace. | Dec 31, 2016 | 4.3 | 14 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Hybris
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.7 | 1 | 6.1 | 1.3% | 0 | 0 |
| 6.6 | 1 | 6.1 | 1.3% | 0 | 0 |
| 6.5 | 1 | 6.1 | 1.3% | 0 | 0 |
| 6.4 | 1 | 6.1 | 1.3% | 0 | 0 |
| 6.3 | 1 | 6.1 | 1.3% | 0 | 0 |
| 6.2 | 1 | 6.1 | 1.3% | 0 | 0 |