Critical severity · published Dec 11, 2019
CVE-2019-0403
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Enable Now · Sap
before 1911 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0403
Permissions Required
https://launchpad.support.sap.com/#/notes/2845183
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533660397
More from Enable Now
8.8
CVE-2019-0341
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set
7.5
CVE-2019-0405
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration…
7.5
CVE-2019-0404
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure
6.5
CVE-2019-0385
SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability
6.1
CVE-2023-36918
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented,…