HIGH🇵🇱 Wersja polska

CVE-2019-0341

CVSS 8.8v3.0pub. 2019-08-14upd. 2024-11-21

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Sap Enable Now

    APP
    Sap
    1902
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2019-0403CRITICAL9.8ten sam produkt

SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be ex...

CVE-2019-0405HIGH7.5ten sam produkt

SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be u...

CVE-2019-0404HIGH7.5ten sam produkt

SAP Enable Now, before version 1911, leaks information about network configuration in the server error message...

CVE-2023-33988MEDIUM6.1ten sam produkt

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1...

CVE-2023-36918MEDIUM6.1ten sam produkt

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1...