Insufficient Session Expiration in SAP Enable Now by SAP
CVE-2020-6197

3.8LOW

Key Information:

Vendor

SAP
Status
SAP Enable Now
Vendor
CVE Published:
10 March 2020

What is CVE-2020-6197?

SAP Enable Now prior to version 1908 has a flaw in its session management where session tokens are not invalidated promptly. This allows an attacker with local access to potentially exploit the session and download sensitive portables, posing a significant risk to data security and user privacy.

Affected Version(s)

SAP Enable Now < before version 1908

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2845363
x_refsource_MISC

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.