Lucene search

[email protected]CVE-2023-40309

HistorySep 12, 2023 - 3:15 a.m.

CVE-2023-40309

2023-09-1203:15:12

CWE-862

[email protected]

web.nvd.nist.gov

sap

commoncryptolib

authentication

vulnerability

privilege escalation

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

Affected configurations

NVD

Node

sapcommoncryptolibMatch8.0.0

sapcontent_serverMatch6.50

sapcontent_serverMatch7.53

sapcontent_serverMatch7.54

sapextended_application_services_and_runtimeMatch1.0

saphana_databaseMatch2.0

saphost_agentMatch722

sapnetweaver_application_server_abapMatch7.22ext

sapnetweaver_application_server_abapMatchkernel_7.22

sapnetweaver_application_server_abapMatchkernel_7.53

sapnetweaver_application_server_abapMatchkernel_7.54

sapnetweaver_application_server_abapMatchkernel_7.77

sapnetweaver_application_server_abapMatchkernel_7.85

sapnetweaver_application_server_abapMatchkernel_7.89

sapnetweaver_application_server_abapMatchkernel_7.91

sapnetweaver_application_server_abapMatchkernel_7.92

sapnetweaver_application_server_abapMatchkernel_7.93

sapnetweaver_application_server_abapMatchkernel_8.04

sapnetweaver_application_server_abapMatchkernel64nuc_7.22

sapnetweaver_application_server_abapMatchkernel64nuc_7.22ext

sapnetweaver_application_server_abapMatchkernel64uc_7.22

sapnetweaver_application_server_abapMatchkernel64uc_7.22ext

sapnetweaver_application_server_abapMatchkernel64uc_7.53

sapnetweaver_application_server_abapMatchkernel64uc_8.04

sapnetweaver_application_server_javaMatchkernel_7.22

sapnetweaver_application_server_javaMatchkernel_7.53

sapnetweaver_application_server_javaMatchkernel_7.54

sapnetweaver_application_server_javaMatchkernel_7.77

sapnetweaver_application_server_javaMatchkernel_7.85

sapnetweaver_application_server_javaMatchkernel_7.89

sapnetweaver_application_server_javaMatchkernel_7.91

sapnetweaver_application_server_javaMatchkernel_7.92

sapnetweaver_application_server_javaMatchkernel_7.93

sapnetweaver_application_server_javaMatchkernel_8.04

sapnetweaver_application_server_javaMatchkernel64nuc_7.22

sapnetweaver_application_server_javaMatchkernel64nuc_7.22ext

sapnetweaver_application_server_javaMatchkernel64uc_7.22

sapnetweaver_application_server_javaMatchkernel64uc_7.22ext

sapnetweaver_application_server_javaMatchkernel64uc_7.53

sapnetweaver_application_server_javaMatchkernel64uc_8.04

sapsapssoextMatch17.0

sapweb_dispatcherMatch7.22ext

sapweb_dispatcherMatch7.53

sapweb_dispatcherMatch7.54

sapweb_dispatcherMatch7.77

sapweb_dispatcherMatch7.85

sapweb_dispatcherMatch7.89

CPENameOperatorVersion
sap:commoncryptolibsap commoncryptolibeq8.0.0
sap:content_serversap content servereq6.50
sap:content_serversap content servereq7.53
sap:content_serversap content servereq7.54
sap:extended_application_services_and_runtimesap extended application services and runtimeeq1.0
sap:hana_databasesap hana databaseeq2.0
sap:host_agentsap host agenteq722
sap:netweaver_application_server_abapsap netweaver application server abapeq7.22ext
sap:netweaver_application_server_abapsap netweaver application server abapeqkernel_7.22
sap:netweaver_application_server_abapsap netweaver application server abapeqkernel_7.53

CPE	Name	Operator	Version
sap:commoncryptolib	sap commoncryptolib	eq	8.0.0
sap:content_server	sap content server	eq	6.50
sap:content_server	sap content server	eq	7.53
sap:content_server	sap content server	eq	7.54
sap:extended_application_services_and_runtime	sap extended application services and runtime	eq	1.0
sap:hana_database	sap hana database	eq	2.0
sap:host_agent	sap host agent	eq	722
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	7.22ext
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	kernel_7.22
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	kernel_7.53

Rows per page:

1-10 of 471

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP CommonCryptoLib",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "8"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "KERNEL 7.22"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.53"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.54"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.77"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.85"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.89"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.91"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.92"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.93"
      },
      {
        "status": "affected",
        "version": "KERNEL 8.04"
      },
      {
        "status": "affected",
        "version": "KERNEL64UC 7.22"
      },
      {
        "status": "affected",
        "version": "KERNEL64UC 7.22EXT"
      },
      {
        "status": "affected",
        "version": "KERNEL64UC 7.53"
      },
      {
        "status": "affected",
        "version": "KERNEL64UC 8.04"
      },
      {
        "status": "affected",
        "version": "KERNEL64NUC 7.22"
      },
      {
        "status": "affected",
        "version": "KERNEL64NUC 7.22EXT"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP Web Dispatcher",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "7.22EXT"
      },
      {
        "status": "affected",
        "version": "7.53"
      },
      {
        "status": "affected",
        "version": "7.54"
      },
      {
        "status": "affected",
        "version": "7.77"
      },
      {
        "status": "affected",
        "version": "7.85"
      },
      {
        "status": "affected",
        "version": "7.89"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP Content Server",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "6.50"
      },
      {
        "status": "affected",
        "version": "7.53"
      },
      {
        "status": "affected",
        "version": "7.54"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP HANA Database",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "2.00"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP Host Agent",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "722"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP Extended Application Services and Runtime (XSA)",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "SAP_EXTENDED_APP_SERVICES 1"
      },
      {
        "status": "affected",
        "version": "XS_ADVANCED_RUNTIME 1.00"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAPSSOEXT",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "17"
      }
    ]
  }
]

References

me.sap.com/notes/3340576

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVE-2023-40309

cvelist1 prion1 nvd1