Vulnerability · Published Jul 11, 2023 · Assigned by sap
CVE-2023-36919Information Disclosure in SAP Enable Now
Medium 5.3
In plain English
A medium-severity security flaw in SAP Enable Now from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 58.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Enable Now | WPB_MANAGER 1.0WPB_MANAGER_CE 10WPB_MANAGER_HANA 10ENABLE_NOW_CONSUMP_DEL 1704 |
Weakness: CWE-213 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N