CVE-2023-36918: Cross-Site Scripting vulnerability in SAP Enable Now

Published Jul 11, 2023

Updated

In SAP Enable Now - versions WPBMANAGER 1.0, WPBMANAGERCE 10, WPBMANAGERHANA 10, ENABLENOWCONSUMPDEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.

Affected Software

1 affected component

SAP Enable Now

Event History

Jul 11, 2023

CVE Published

via MITRE·02:49 AM

Data Sourced

via MITRE·02:49 AM

DescriptionSeverity

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this SAP Enable Now vulnerability?

The vulnerability ID of this SAP Enable Now vulnerability is CVE-2023-36918.

What is the severity level of CVE-2023-36918?

The severity level of CVE-2023-36918 is medium with a CVSS score of 6.1.

How does CVE-2023-36918 impact SAP Enable Now?

CVE-2023-36918 allows an unauthenticated attacker to trigger MIME type sniffing, leading to Cross-Site Scripting vulnerability in SAP Enable Now.

What is the affected software of CVE-2023-36918?

The affected software of CVE-2023-36918 is SAP Enable Now with versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704.

How can I fix the CVE-2023-36918 vulnerability in SAP Enable Now?

To fix the CVE-2023-36918 vulnerability in SAP Enable Now, you should implement the X-Content-Type-Options response header to prevent MIME type sniffing.