CVE-2019-0403

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-11 · updated 2026-06-17
Weakness: CWE-1236

Description

SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection.

Affected products

SAP SE SAP Enable Now: before 1911 — fixed in 1911

How to fix

Upgrade to a fixed version: SAP SE SAP Enable Now 1911. Check the vendor advisory for mitigations.

References

https://launchpad.support.sap.com/#/notes/2845183
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533660397
https://launchpad.support.sap.com/#/notes/2845183
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533660397

Get alerted when CVE-2019-0403 or the next vulnerability affects your stack