High severity · published Aug 14, 2019
CVE-2019-0341
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Enable Now · Sap
1902 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0341
Permissions Required
https://launchpad.support.sap.com/#/notes/2794742
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
More from Enable Now
9.8
CVE-2019-0403
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection
7.5
CVE-2019-0405
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration…
7.5
CVE-2019-0404
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure
6.5
CVE-2019-0385
SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability
6.1
CVE-2023-36918
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented,…