Auth bypass in Sap Commoncryptolib
CVE-2023-40309
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of…
Vulnerability class: Broken Access Control
EPSS: 0.007 (50.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sap Commoncryptolib — versions 8.0.0
- Sap Content_server — versions 6.50, 7.53, 7.54
- Sap Extended_application_services_and_runtime — versions 1.0
- Sap Hana_database — versions 2.0
- Sap Host_agent — versions 722
- Sap Netweaver_application_server_abap — versions 7.22ext, kernel_7.22, kernel_7.53
- Sap Netweaver_application_server_java — versions kernel_7.22, kernel_7.53, kernel_7.54
- Sap Sapssoext — versions 17.0
- Sap Web_dispatcher — versions 7.22ext, 7.53, 7.54
- Sap_se Sap Commoncryptolib — versions 8
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required, Vendor Advisory)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-40309?
- CVE-2023-40309 is a critical-severity vulnerability in Sap Commoncryptolib, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2023-09-12.
- How severe is CVE-2023-40309?
- Critical severity. CVSS v3 base score is 9.8 out of 10.