CVE-2023-39436 : SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM.

Published 2023-08-08 01:15:19

Updated 2024-09-28 22:15:04

Source SAP SE

View at NVD, CVE.org

Products affected by CVE-2023-39436

SAP » Supplier Relationship Management » Version: 600
cpe:2.3:a:sap:supplier_relationship_management:600:*:*:*:*:*:*:*
Matching versions
SAP » Supplier Relationship Management » Version: 602
cpe:2.3:a:sap:supplier_relationship_management:602:*:*:*:*:*:*:*
Matching versions
SAP » Supplier Relationship Management » Version: 603
cpe:2.3:a:sap:supplier_relationship_management:603:*:*:*:*:*:*:*
Matching versions
SAP » Supplier Relationship Management » Version: 604
cpe:2.3:a:sap:supplier_relationship_management:604:*:*:*:*:*:*:*
Matching versions
SAP » Supplier Relationship Management » Version: 605
cpe:2.3:a:sap:supplier_relationship_management:605:*:*:*:*:*:*:*
Matching versions
SAP » Supplier Relationship Management » Version: 606
cpe:2.3:a:sap:supplier_relationship_management:606:*:*:*:*:*:*:*
Matching versions
SAP » Supplier Relationship Management » Version: 616
cpe:2.3:a:sap:supplier_relationship_management:616:*:*:*:*:*:*:*
Matching versions
SAP » Supplier Relationship Management » Version: 617
cpe:2.3:a:sap:supplier_relationship_management:617:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-39436

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-39436

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N	3.9	1.4	SAP SE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: Low Integrity: None Availability: None
5.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-39436

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: cna@sap.com (Primary)
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: cna@sap.com (Primary)

References for CVE-2023-39436

https://me.sap.com/notes/2067220

SAP for Me: Sign In
Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

SAP Patch Day Blog
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-39436

Products affected by CVE-2023-39436

Exploit prediction scoring system (EPSS) score for CVE-2023-39436

CVSS scores for CVE-2023-39436

CWE ids for CVE-2023-39436

References for CVE-2023-39436