CVE Database
/

CVE-2023-40309

Back to search

CVE-2023-40309

Published: Sep 12, 2023

Modified: Sep 28, 2024

PUBLISHED

CVSS v3.1

9.8

CRITICAL

Description

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

VendorProductVersions

SAP_SE

SAP CommonCryptoLib

affected
8

SAP_SE

SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise

affected
KERNEL 7.22
affected
KERNEL 7.53
affected
KERNEL 7.54
affected
KERNEL 7.77
affected
KERNEL 7.85

+11 more versions

SAP_SE

SAP Web Dispatcher

affected
7.22EXT
affected
7.53
affected
7.54
affected
7.77
affected
7.85

+1 more versions

SAP_SE

SAP Content Server

affected
6.50
affected
7.53
affected
7.54

SAP_SE

SAP HANA Database

affected
2.00

SAP_SE

SAP Host Agent

affected
722

SAP_SE

SAP Extended Application Services and Runtime (XSA)

affected
SAP_EXTENDED_APP_SERVICES 1
affected
XS_ADVANCED_RUNTIME 1.00

SAP_SE

SAPSSOEXT

affected
17

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now