SB2023072760 - Multiple HTTP headers misconfigurations in SAP Enable Now
Published: July 27, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Configuration (CVE-ID: CVE-2023-36920)
The issue may allow a remote attacker to perform XSS attacks.
The issue exists due to application does not implement the necessary HTTP response headers. A remote attacker can launch an XSS attack against the application in case the application is vulnerable to a cross-site scripting vulnerability.
2) Configuration (CVE-ID: CVE-2023-36919)
The issue may allow a remote attacker to gain access to sensitive information.
The
issue exists due to application does not implement the Referrer-Policy response header. A remote
attacker can obtain potentially sensitive information passed via the Referer HTTP header.
3) Configuration (CVE-ID: CVE-2023-36918)
The issue may allow a remote attacker to perform XSS attacks.
The issue exists due to application does not implement the X-Content-Type-Options response header. A remote attacker can launch an XSS attack against the application in case the application is vulnerable to a cross-site scripting vulnerability.
4) Configuration (CVE-ID: CVE-2023-33988)
The issue may allow a remote attacker to perform XSS attacks.
The issue exists due to application does not implement the Content-Security-Policy and X-XSS-Protection response headers. A remote attacker can launch an XSS attack against the application in case the application is vulnerable to a cross-site scripting vulnerability.
Note, the "X-XSS-Protection" header is considered deprecated and should not be relied on when protecting web application against XSS attacks.
Remediation
Install update from vendor's website.