CVE-2023-40309

Missing Authorization check in SAP CommonCryptoLib

State: Published
Severity: 9.8 Critical
Published: Sep 12, 2023
Updated: Sep 28, 2024
Reserved: Aug 14, 2023

Description

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	sap

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
SAP CommonCryptoLibSAP_SE	8Affected
SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premiseSAP_SE	KERNEL 7.22Affected KERNEL 7.53Affected KERNEL 7.54Affected KERNEL 7.77Affected KERNEL 7.85Affected KERNEL 7.89Affected KERNEL 7.91Affected KERNEL 7.92Affected KERNEL 7.93Affected KERNEL 8.04Affected KERNEL64UC 7.22Affected KERNEL64UC 7.22EXTAffected KERNEL64UC 7.53Affected KERNEL64UC 8.04Affected KERNEL64NUC 7.22Affected KERNEL64NUC 7.22EXTAffected
SAP Web DispatcherSAP_SE	7.22EXTAffected 7.53Affected 7.54Affected 7.77Affected 7.85Affected 7.89Affected
SAP Content ServerSAP_SE	6.50Affected 7.53Affected 7.54Affected
SAP HANA DatabaseSAP_SE	2.00Affected
SAP Host AgentSAP_SE	722Affected
SAP Extended Application Services and Runtime (XSA)SAP_SE	SAP_EXTENDED_APP_SERVICES 1Affected XS_ADVANCED_RUNTIME 1.00Affected
SAPSSOEXTSAP_SE	17Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.