{"id":"CVE-2023-39436","state":"PUBLISHED","title":"Information Disclosure in SAP Supplier Relationship Management","description":"SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM.","publishedAt":"2023-08-08T00:48:18.892Z","updatedAt":"2024-10-15T20:13:19.519Z","severity":{"score":5.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","source":"sap"},"assigner":"sap","products":["SAP_SE SAP Supplier Relationship Management"],"affected":[{"vendor":"SAP_SE","product":"SAP Supplier Relationship Management","defaultStatus":"unaffected","versions":[{"version":"600","status":"affected"},{"version":"602","status":"affected"},{"version":"603","status":"affected"},{"version":"604","status":"affected"},{"version":"605","status":"affected"},{"version":"606","status":"affected"},{"version":"616","status":"affected"},{"version":"617","status":"affected"}]}],"references":["https://me.sap.com/notes/2067220","https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/39xxx/CVE-2023-39436.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-39436","state":"PUBLISHED","datePublished":"2023-08-08T00:48:18.892Z","dateUpdated":"2024-10-15T20:13:19.519Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2023-08-01T21:49:02.687Z"},"containers":{"cna":{"title":"Information Disclosure in SAP Supplier Relationship Management","descriptions":[{"lang":"en","value":"SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM."}],"affected":[{"vendor":"SAP_SE","product":"SAP Supplier Relationship Management","defaultStatus":"unaffected","versions":[{"version":"600","status":"affected"},{"version":"602","status":"affected"},{"version":"603","status":"affected"},{"version":"604","status":"affected"},{"version":"605","status":"affected"},{"version":"606","status":"affected"},{"version":"616","status":"affected"},{"version":"617","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/2067220"},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306: Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2024-09-28T22:07:01.413Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://me.sap.com/notes/2067220","tags":["x_transferred"]},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T18:10:20.665Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-15T20:13:08.498052Z","id":"CVE-2023-39436","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-15T20:13:19.519Z"}}]}}}