CVE-2023-36919: sap_se sap enable now

Vulnerability summary

CVE-2023-36919 is a medium (CVSS 5.3) vulnerability in sap_se sap enable now. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.5% of scored vulnerabilities.

Timeline

1. 11-07-2023
   PublishedVulnerability first disclosed.
2. 12-11-2024
   Last modifiedVulnerability information updated.

Description

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.

• CWE-213Exposure of Sensitive Information Due to Incompatible PoliciesThe product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.