CVEvulnerability

CVE-2023-40309

9.8 CRITICAL Published 2023-09-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-09-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863

Description

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

Affected configurations

• sap commoncryptolib 8.0.0 • sap content server 6.50 • sap content server 7.53 • sap content server 7.54 • sap extended application services and runtime 1.0 • sap hana database 2.0 • sap host agent 722 • sap netweaver application server abap 7.22ext • sap netweaver application server abap kernel 7.22 • sap netweaver application server abap kernel 7.53 • sap netweaver application server abap kernel 7.54 • sap netweaver application server abap kernel 7.77 • sap netweaver application server abap kernel 7.85 • sap netweaver application server abap kernel 7.89 • sap netweaver application server abap kernel 7.91 • sap netweaver application server abap kernel 7.92 • sap netweaver application server abap kernel 7.93 • sap netweaver application server abap kernel 8.04 • sap netweaver application server abap kernel64nuc 7.22 • sap netweaver application server abap kernel64nuc 7.22ext • sap netweaver application server abap kernel64uc 7.22 • sap netweaver application server abap kernel64uc 7.22ext • sap netweaver application server abap kernel64uc 7.53 • sap netweaver application server abap kernel64uc 8.04 • sap netweaver application server java kernel 7.22 • sap netweaver application server java kernel 7.53 • sap netweaver application server java kernel 7.54 • sap netweaver application server java kernel 7.77 • sap netweaver application server java kernel 7.85 • sap netweaver application server java kernel 7.89 • sap netweaver application server java kernel 7.91 • sap netweaver application server java kernel 7.92 • sap netweaver application server java kernel 7.93 • sap netweaver application server java kernel 8.04 • sap netweaver application server java kernel64nuc 7.22 • sap netweaver application server java kernel64nuc 7.22ext • sap netweaver application server java kernel64uc 7.22 • sap netweaver application server java kernel64uc 7.22ext • sap netweaver application server java kernel64uc 7.53 • sap netweaver application server java kernel64uc 8.04 • sap sapssoext 17.0 • sap web dispatcher 7.22ext • sap web dispatcher 7.53 • sap web dispatcher 7.54 • sap web dispatcher 7.77 • sap web dispatcher 7.85 • sap web dispatcher 7.89

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References