CVE-2023-36920

MEDIUM 6.1CVE-2023-36920 · Published 30/10/2023 · updated 17/06/2026

In short

CVE-2023-36920 is a MEDIUM (CVSS 6.1) vulnerability affecting enable now enable now consump del (sap), enable now wpb manager (sap), enable now wpb manager ce (sap).
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 29.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
enable now enable now consump del sap	`= 1704`	No fix yet
enable now wpb manager sap	`= 1.0`	No fix yet
enable now wpb manager ce sap	`= 10`	No fix yet
enable now wpb manager hana sap	`= 10`	No fix yet

Description

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.

References

launchpad.support.sap.com · Permissions Required
sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free