CVE-2023-36918
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented. This allows an unauthenticated attacker to trigger MIME type sniffing, leading to Cross-Site Scripting.
Risk Assessment
An attacker could disclose or modify information, posing a serious threat to the organization's data security.
Recommendation
It is recommended to implement the X-Content-Type-Options header in server responses to prevent MIME type sniffing and associated XSS attacks.
Original NVD description (English source)
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.