title: Information Disclosure in SAP Supplier Relationship Management
description: SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM.
problem types: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: SAP Supplier Relationship Management
vendor: SAP_SE
versions:
status: affected, version: 600
status: affected, version: 602
status: affected, version: 603
status: affected, version: 604
status: affected, version: 605
status: affected, version: 606
status: affected, version: 616
status: affected, version: 617
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL