« Volver al listado

CVE-2023-36920

Estado: ModificadaMedia (6.1)—

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

SAP — Enable NOW Enable NOW Consump DELSAP — Enable NOW WPB ManagerSAP — Enable NOW WPB Manager CESAP — Enable NOW WPB Manager Hana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-36920",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-36920",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-06T20:33:23.937556Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Enable Now",
          "versions": [
            {
              "status": "affected",
              "version": "WPB_MANAGER 1.0, WPB_MANAGER_CE 10"
            },
            {
              "status": "affected",
              "version": "WPB_MANAGER_HANA 10"
            },
            {
              "status": "affected",
              "version": "ENABLE_NOW_CONSUMP_DEL 1704"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-10-30T17:15:52.260",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3326769",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3326769",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.\n\n\n"
    },
    {
      "lang": "es",
      "value": "En SAP Enable Now - versiones WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS el encabezado de respuesta no está implementado, lo que permite que un atacante no autenticado intente hacer click, lo que podría resultar en la divulgación o modificación de información."
    }
  ],
  "lastModified": "2026-06-17T06:07:22.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:enable_now_enable_now_consump_del:1704:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C52E900-DC61-4CAF-B44C-620BE1159809"
            },
            {
              "criteria": "cpe:2.3:a:sap:enable_now_wpb_manager:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A615B74-6E92-4697-BB88-53F8CB644644"
            },
            {
              "criteria": "cpe:2.3:a:sap:enable_now_wpb_manager_ce:10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDD4FB19-3590-4E47-A179-55C3DDC329B7"
            },
            {
              "criteria": "cpe:2.3:a:sap:enable_now_wpb_manager_hana:10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96C53603-D5E9-4F2C-8D15-3AC2EFF6BA66"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}