PT-2023-25740 · Sap · Sap Enable Now

Published 2023-10-30 · Updated 2023-11-08 · CVE-2023-36920

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704

Description The issue is related to the absence of the X-FRAME-OPTIONS response header in SAP Enable Now, allowing an unauthenticated attacker to attempt clickjacking. This could result in the disclosure or modification of information.

Recommendations For SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704, consider implementing the X-FRAME-OPTIONS response header to prevent clickjacking attacks. As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2023-36920

Affected Products

Sap Enable Now

References · 6

• https://osv.dev/vulnerability/CVE-2023-36920 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36920 · Security Note
• https://t.me/cibsecurity/73150 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3326769 · Note
• https://twitter.com/CVEnew/status/1719046538847285252 · Twitter Post