Read the docs
TI-2019-00282 Aliases CVE-2019-0341GHSA-3cjx-w9jj-45qv

Incorrect permission assignment in SAP Enable Now

Priority MEDIUM 40CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.

Why it matters now

EPSS 0.0106 64th percentileScored 2026-11-07
Fix Fixed SAP Enable Now (SAP SE): 1902

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Enable Nowbefore 19021902Patch availableCNA
  • SAP Enable Now VendorSAP Affected before 1902 Fixed in 1902 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:enable_now:1902:*:*:*:*:*:*:*1902VulnerableSAP
  • cpe:2.3:a:sap:enable_now:1902:*:*:*:*:*:*:* Versions 1902 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Enable Now (SAP SE) Fixed in 1902

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0341
  2. 2026-10-03 Alias added: GHSA-3cjx-w9jj-45qv

References

Advisory 2

  • TI-2019-00327 CSV injection in SAP Enable Now CVSS 3.1CRITICAL 9.8
  • TI-2019-00329 Information disclosure in SAP Enable Now CVSS 3.1HIGH 7.5
  • TI-2019-00328 Information disclosure through error messages in SAP Enable Now CVSS 3.1HIGH 7.5
  • TI-2023-18703 Information Disclosure in SAP Enable Now CVSS 3.1MEDIUM 5.3
  • TI-2019-00315 Cross-site scripting in SAP Enable Now CVSS 3.1MEDIUM 6.5
  • TI-2023-18702 Cross-Site Scripting vulnerability in SAP Enable Now CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences