Information disclosure in SAP Gateway
Priority LOW 26CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.
Why it matters now
EPSS 0.01111 66th percentileScored 2026-11-07
Fix Fixed SAP Gateway (SAP SE): 750, 751, 752 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Gateway | before 750; before 751; before 752; before 753 | 750, 751, 752, 753 | Patch available | CNA |
- SAP Gateway VendorSAP Affected before 750; before 751; before 752; before 753 Fixed in 750, 751, 752, 753 Patch available CNA
Remediation
- Fix · CNA SAP Gateway (SAP SE) Fixed in 750, 751, 752, 753
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0338
- 2026-10-03 Alias added: GHSA-rww3-gp24-435c
References
More SAP Gateway vulnerabilities
- TI-2019-00265 Injection in SAP Gateway CVSS 3.0HIGH 7.5
Sources
- CVE-2019-0338 · CVE Program
- CVE-2019-0338 · NVD
- FIRST EPSS
- GHSA-rww3-gp24-435c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences