PT-2023-4098 · Sap · Sap Enable Now

Published 2023-07-11 · Updated 2024-09-28 · CVE-2023-36919

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704

Description The issue is related to the lack of implementation of the Referrer-Policy response header in SAP Enable Now, allowing an unauthenticated attacker to obtain referrer details. This results in information disclosure. The vulnerability is associated with insufficient processing of HTTP requests, which can be exploited by a remote attacker to bypass existing security restrictions and disclose protected information using the HTTP referer header.

Recommendations For SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704, consider implementing the Referrer-Policy response header to prevent information disclosure. As a temporary workaround, restrict access to sensitive information that could be disclosed through referrer details until a patch is available.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-644

CWE-213

CWE-16

CWE-116

Related Identifiers

BDU:2023-04401

CVE-2023-36919

Affected Products

Sap Enable Now

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-36919 · Security Note
• https://bdu.fstec.ru/vul/2023-04401 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3326769 · Note
• https://cybersecurity-help.cz/vdb/SB2023072760 · Note
• https://t.me/cvenotify/96486 · Telegram Post