CVE-2019-0341

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set

published August 14, 2019

CVSS
—
EPSS
1%
Percentile
64.2
In the wild
Unconfirmed
What it is

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01060 · 64.2th percentile
Published
2019-08-14T13:50Z
EPSS history
Timeline
  • 14 AUG 13:50Z
    The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set
    cvelistv5