CVE-2023-36918
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented. This allows an unauthenticated attacker to trigger MIME type sniffing, leading to Cross-Site Scripting.
Risk Assessment
An attacker could disclose or modify information, posing a serious threat to the organization's data security.
Recommendation
It is recommended to implement the X-Content-Type-Options header in server responses to prevent MIME type sniffing and associated XSS attacks.
Other vulnerabilities in SAP Enable Now
See all- CVE-2022-35293Critical
Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application.
- CVE-2023-36919Medium
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.
- CVE-2023-33988Medium
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are missing. This allows an unauthenticated attacker to attempt reflected cross-site scripting, which could lead to disclosure or modification of information.
Original NVD description (English source)
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.