Lucene search

SapCVELIST:CVE-2023-36919

HistoryJul 11, 2023 - 2:54 a.m.

CVE-2023-36919 Information Disclosure in SAP Enable Now

2023-07-1102:54:02

CWE-213

sap

www.cve.org

sap

enable now

information disclosure

referrer-policy

unauthenticated attacker

information disclosure

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

35.8%

JSON

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Enable Now",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "WPB_MANAGER 1.0"
      },
      {
        "status": "affected",
        "version": "WPB_MANAGER_CE 10"
      },
      {
        "status": "affected",
        "version": "WPB_MANAGER_HANA 10"
      },
      {
        "status": "affected",
        "version": "ENABLE_NOW_CONSUMP_DEL 1704"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3326769

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

35.8%

JSON

Related for CVELIST:CVE-2023-36919