Cross site scripting

2023-07-1103:15:00

PRIOn knowledge base

www.prio-n.com

sap enable now

mime type sniffing

cross-site scripting

disclosure

modification

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.3%

JSON

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.