What is CVE-2023-39436?

CVE-2023-39436 is a medium-severity vulnerability in SAP Supplier Relationship Management, classified under Missing Authentication for Critical Function. CVSS score: 5.8/10. Published 2023-08-08.

How severe is CVE-2023-39436?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Auth bypass in SAP Supplier Relationship Management

CVE-2023-39436

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM.

Vulnerability class: Broken Authentication

EPSS: 0.004 (29.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Affected products

Sap Supplier_relationship_management — versions 600, 602, 603
Sap_se Sap Supplier Relationship Management — versions 600, 602, 603

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-39436?: CVE-2023-39436 is a medium-severity vulnerability in SAP Supplier Relationship Management, classified under Missing Authentication for Critical Function. CVSS score: 5.8/10. Published 2023-08-08.
How severe is CVE-2023-39436?: Medium severity. CVSS v3 base score is 5.8 out of 10.