CVE-2019-0341

CVE-2019-0341 describes a vulnerability in SAP Enable Now, version 1902, where the session cookie lacks the HttpOnly flag. This oversight allows an attacker to access the session cookie if they can execute script code within the application's context, potentially leading to unauthorized application access. The vulnerability carries a high CVSS score of 8.8, indicating a significant risk due to its network-based attack vector and low attack complexity, which can result in high impacts to confidentiality, integrity, and availability. While the EPSS score is low, suggesting limited real-world exploitation, the FAUCET Risk Score of 68/100 still highlights its potential severity. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The vulnerability has also garnered minimal community discussion and media coverage, suggesting it is not widely known or actively targeted.