CVE-2023-33988
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are missing. This allows an unauthenticated attacker to attempt reflected cross-site scripting, which could lead to disclosure or modification of information.
Risk Assessment
The absence of proper security headers increases the risk of XSS attacks, which can result in serious data breaches and loss of confidentiality within the organization.
Recommendation
It is recommended to implement Content-Security-Policy and X-XSS-Protection headers in server responses to minimize the risk of XSS attacks.
Original NVD description (English source)
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in disclosure or modification of information.