CVE-2020-6178

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-10 · updated 2026-06-17
Weakness: CWE-200

Description

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure.

Affected products

SAP SE SAP Enable Now: before 1911 — fixed in 1911

How to fix

Upgrade to a fixed version: SAP SE SAP Enable Now 1911. Check the vendor advisory for mitigations.

References

https://launchpad.support.sap.com/#/notes/2880664
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
https://launchpad.support.sap.com/#/notes/2880664
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305

Get alerted when CVE-2020-6178 or the next vulnerability affects your stack