PT-2023-4096 · Sap · Sap Enable Now

Published 2023-07-11 · Updated 2023-07-27 · CVE-2023-36918

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704

Description The issue is related to the absence of the X-Content-Type-Options response header, which allows an unauthenticated attacker to trigger MIME type sniffing. This can lead to Cross-Site Scripting (XSS), potentially resulting in the disclosure or modification of information. The vulnerability can be exploited by a remote attacker to conduct XSS attacks.

Recommendations For SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704, consider implementing the X-Content-Type-Options response header to prevent MIME type sniffing and mitigate the risk of Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-16

CWE-79

Related Identifiers

BDU:2023-04399

CVE-2023-36918

Affected Products

Sap Enable Now

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-36918 · Security Note
• https://bdu.fstec.ru/vul/2023-04399 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2023072760 · Note
• https://launchpad.support.sap.com/#/notes/3326769 · Note