CVE-2023-39436
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In SAP Supplier Relationship Management versions 600, 602, 603, 604, 605, 606, 616, 617, there is a vulnerability that allows an unauthorized attacker to discover information related to SRM within Vendor Master Data. This information could be used to tailor attacks against SRM.
Risk Assessment
This vulnerability poses a risk that an attacker could gain sensitive information, potentially leading to more sophisticated attacks on the SRM system. This could result in data breaches and loss of trust in the system.
Recommendation
It is recommended to update the system to the latest version to mitigate this vulnerability and implement additional security measures, such as monitoring access to vendor master data.
Original NVD description (English source)
SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM.