CVE-2023-36920

Name: CVE-2023-36920
Creator: NVD / NIST
Published: 2023-10-30T17:15:52.26+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.1/10EPSS 0.31%

Last modified Jun 17, 2026

CVE-2023-36920 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information. . EPSS estimates a 0.31% chance of exploitation in the next 30 days.

Description

In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.

Metrics

CVSS 3.1

6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

0.31%

22.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Sap	Enable Now Enable Now Consump Del	1704
Sap	Enable Now Wpb Manager	1.0
Sap	Enable Now Wpb Manager Ce	10
Sap	Enable Now Wpb Manager Hana	10

References

https://launchpad.support.sap.com/#/notes/3326769Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3326769Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Oct 30, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-36920?

How severe is CVE-2023-36920?

CVE-2023-36920 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.31% probability of exploitation in the next 30 days.

How do I fix CVE-2023-36920?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-36920?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST