CVE-2020-6178

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL

Medium · published March 10, 2020

CVSS v3.0
5.4
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00726 · 53.6th percentile
Published
2020-03-10T20:17Z
EPSS history
Timeline
  • 10 MAR 20:17Z
    SAP Enable Now, before version 1911, sends the Session ID cookie value in URL
    cvelistv5