CVE-2023-39436

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-394375.4SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets iCVE-2023-394388.1A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by execuCVE-2023-394399.8SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without aCVE-2023-39446.1A vulnerability was found in phpscriptpoint Lawyer 1.6 and classified as problematic. Affected by this issue is some unknown functionality oCVE-2023-394404.4In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions meCVE-2023-394415.9Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the VaCVE-2023-394437.8Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can CVE-2023-394447.8Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can CVE-2023-394458.8Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execuCVE-2023-394468.8Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headerCVE-2023-394474.4When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log.   Note: Software veCVE-2023-394488.8Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the