Read the docs
TI-2019-00327 Aliases CVE-2019-0403GHSA-jpvg-r6vh-56w3

CSV injection in SAP Enable Now

Priority MEDIUM 46CWE-1236Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection.

Why it matters now

EPSS 0.02089 81st percentileScored 2026-11-07
Fix Fixed SAP Enable Now (SAP SE): 1911

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Enable Nowbefore 19111911Patch availableCNA
  • SAP Enable Now VendorSAP Affected before 1911 Fixed in 1911 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:enable_now:*:*:*:*:*:*:*:*before 1911VulnerableSAP
  • cpe:2.3:a:sap:enable_now:*:*:*:*:*:*:*:* Versions before 1911 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Enable Now (SAP SE) Fixed in 1911

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0403
  2. 2026-10-03 Alias added: GHSA-jpvg-r6vh-56w3

References

Advisory 2

  • TI-2019-00282 Incorrect permission assignment in SAP Enable Now CVSS 3.0HIGH 8.8
  • TI-2019-00329 Information disclosure in SAP Enable Now CVSS 3.1HIGH 7.5
  • TI-2019-00328 Information disclosure through error messages in SAP Enable Now CVSS 3.1HIGH 7.5
  • TI-2023-18703 Information Disclosure in SAP Enable Now CVSS 3.1MEDIUM 5.3
  • TI-2019-00315 Cross-site scripting in SAP Enable Now CVSS 3.1MEDIUM 6.5
  • TI-2023-18702 Cross-Site Scripting vulnerability in SAP Enable Now CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences