Lucene search

SapCVELIST:CVE-2023-33988

HistoryJul 11, 2023 - 2:26 a.m.

CVE-2023-33988 Cross-Site Scripting vulnerability in SAP Enable Now

2023-07-1102:26:57

CWE-79

sap

www.cve.org

cve-2023-33988

sap enable now

cross-site scripting

vulnerability

content-security-policy

x-xss-protection

unauthenticated attacker

reflected cross-site scripting

information disclosure

information modification

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

33.3%

JSON

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in disclosure or modification of information.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Enable Now",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "WPB_MANAGER 1.0"
      },
      {
        "status": "affected",
        "version": "WPB_MANAGER_CE 10"
      },
      {
        "status": "affected",
        "version": "WPB_MANAGER_HANA 10"
      },
      {
        "status": "affected",
        "version": "ENABLE_NOW_CONSUMP_DEL 1704"
      }
    ]
  }
]

References

me.sap.com/notes/3326769

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

33.3%

JSON

Related for CVELIST:CVE-2023-33988