Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-40309

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

Published

2023-09-12T03:15:12.073

Last Modified

2024-11-21T08:19:12.560

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Primary
    CWE-863
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sap commoncryptolib 8.0.0 Yes
Application sap content_server 6.50 Yes
Application sap content_server 7.53 Yes
Application sap content_server 7.54 Yes
Application sap extended_application_services_and_runtime 1.0 Yes
Application sap hana_database 2.0 Yes
Application sap host_agent 722 Yes
Application sap netweaver_application_server_abap 7.22ext Yes
Application sap netweaver_application_server_abap kernel_7.22 Yes
Application sap netweaver_application_server_abap kernel_7.53 Yes
Application sap netweaver_application_server_abap kernel_7.54 Yes
Application sap netweaver_application_server_abap kernel_7.77 Yes
Application sap netweaver_application_server_abap kernel_7.85 Yes
Application sap netweaver_application_server_abap kernel_7.89 Yes
Application sap netweaver_application_server_abap kernel_7.91 Yes
Application sap netweaver_application_server_abap kernel_7.92 Yes
Application sap netweaver_application_server_abap kernel_7.93 Yes
Application sap netweaver_application_server_abap kernel_8.04 Yes
Application sap netweaver_application_server_abap kernel64nuc_7.22 Yes
Application sap netweaver_application_server_abap kernel64nuc_7.22ext Yes
Application sap netweaver_application_server_abap kernel64uc_7.22 Yes
Application sap netweaver_application_server_abap kernel64uc_7.22ext Yes
Application sap netweaver_application_server_abap kernel64uc_7.53 Yes
Application sap netweaver_application_server_abap kernel64uc_8.04 Yes
Application sap netweaver_application_server_java kernel_7.22 Yes
Application sap netweaver_application_server_java kernel_7.53 Yes
Application sap netweaver_application_server_java kernel_7.54 Yes
Application sap netweaver_application_server_java kernel_7.77 Yes
Application sap netweaver_application_server_java kernel_7.85 Yes
Application sap netweaver_application_server_java kernel_7.89 Yes
Application sap netweaver_application_server_java kernel_7.91 Yes
Application sap netweaver_application_server_java kernel_7.92 Yes
Application sap netweaver_application_server_java kernel_7.93 Yes
Application sap netweaver_application_server_java kernel_8.04 Yes
Application sap netweaver_application_server_java kernel64nuc_7.22 Yes
Application sap netweaver_application_server_java kernel64nuc_7.22ext Yes
Application sap netweaver_application_server_java kernel64uc_7.22 Yes
Application sap netweaver_application_server_java kernel64uc_7.22ext Yes
Application sap netweaver_application_server_java kernel64uc_7.53 Yes
Application sap netweaver_application_server_java kernel64uc_8.04 Yes
Application sap sapssoext 17.0 Yes
Application sap web_dispatcher 7.22ext Yes
Application sap web_dispatcher 7.53 Yes
Application sap web_dispatcher 7.54 Yes
Application sap web_dispatcher 7.77 Yes
Application sap web_dispatcher 7.85 Yes
Application sap web_dispatcher 7.89 Yes
References