CVE-2023-33988

CVE-2023-33988 is a reflected cross-site scripting (XSS) vulnerability affecting SAP Enable Now versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, and ENABLE_NOW_CONSUMP_DEL 1704. The vulnerability stems from the absence of Content-Security-Policy and X-XSS-Protection response headers. With a CVSS score of 6.1 (Medium), an unauthenticated attacker could exploit this remotely with low complexity, potentially leading to information disclosure or modification if a user interacts with a malicious link. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.