CVE-2023-36919: Information Disclosure in SAP Enable Now

Published Jul 11, 2023

Updated

In SAP Enable Now - versions WPBMANAGER 1.0, WPBMANAGERCE 10, WPBMANAGERHANA 10, ENABLENOWCONSUMPDEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.

Affected Software

1 affected component

SAP Enable Now

Event History

Jul 11, 2023

CVE Published

via MITRE·02:54 AM

Data Sourced

via MITRE·02:54 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this SAP Enable Now vulnerability?

The vulnerability ID of this SAP Enable Now vulnerability is CVE-2023-36919.

What is the severity of CVE-2023-36919?

The severity of CVE-2023-36919 is medium with a CVSS score of 5.3.

How does this vulnerability in SAP Enable Now occur?

This vulnerability occurs because the Referrer-Policy response header is not implemented in SAP Enable Now, allowing an unauthenticated attacker to obtain referrer details and resulting in information disclosure.

Which versions of SAP Enable Now are affected by CVE-2023-36919?

Versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704 are affected by CVE-2023-36919.

How can I fix the vulnerability in SAP Enable Now (CVE-2023-36919)?

To fix the vulnerability, apply the necessary patches or updates provided by SAP, as mentioned in the references.