{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39436", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2023-08-01T21:49:02.687Z", "datePublished": "2023-08-08T00:48:18.892Z", "dateUpdated": "2024-08-02T18:10:20.665Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Supplier Relationship Management", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "600"}, {"status": "affected", "version": "602"}, {"status": "affected", "version": "603"}, {"status": "affected", "version": "604"}, {"status": "affected", "version": "605"}, {"status": "affected", "version": "606"}, {"status": "affected", "version": "616"}, {"status": "affected", "version": "617"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to\u00a0SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against\u00a0SRM.</p>"}], "value": "SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to\u00a0SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against\u00a0SRM.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2023-08-08T00:48:18.892Z"}, "references": [{"url": "https://me.sap.com/notes/2067220"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Information Disclosure in SAP Supplier Relationship Management", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:10:20.665Z"}, "title": "CVE Program Container", "references": [{"url": "https://me.sap.com/notes/2067220", "tags": ["x_transferred"]}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:supplier_relationship_management:600:*:*:*:*:*:*:*", "matchCriteriaId": "55527525-88C2-4FAD-AD3F-023928317556", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management:602:*:*:*:*:*:*:*", "matchCriteriaId": "15FDAEAF-58BD-4839-839F-A1E8C8E0E0AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management:603:*:*:*:*:*:*:*", "matchCriteriaId": "794DE5E4-B5A6-4ACC-8EBF-F76FCAD7369C", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management:604:*:*:*:*:*:*:*", "matchCriteriaId": "685CA87A-7F6F-4D75-83D9-C5F26201257D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management:605:*:*:*:*:*:*:*", "matchCriteriaId": "189F4096-39A5-44E6-B954-70B45FA1F695", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management:606:*:*:*:*:*:*:*", "matchCriteriaId": "24247E81-67E8-42DE-9871-2EC7F0960A98", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management:616:*:*:*:*:*:*:*", "matchCriteriaId": "2EFCE15C-77A9-4C6E-8616-3F7EBA1EB220", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:supplier_relationship_management:617:*:*:*:*:*:*:*", "matchCriteriaId": "67BE6CAE-5A02-4567-ADEA-2B16C763CA06", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to\u00a0SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against\u00a0SRM.\n\n"}], "id": "CVE-2023-39436", "lastModified": "2023-08-09T18:19:29.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}]}, "published": "2023-08-08T01:15:19.150", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/2067220"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "cna@sap.com", "type": "Primary"}]}

{}