CVE-2023-39436: Information Disclosure in SAP Supplier Relationship Management

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-08 · updated 2026-06-17
Weakness: CWE-306

Description

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM.

Affected products

SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit): 600, 602, 603, 604, 605, 606 (+2)

References

https://me.sap.com/notes/2067220
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
https://me.sap.com/notes/2067220
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Get alerted when CVE-2023-39436 or the next vulnerability affects your stack