VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Sep 12, 2023· Updated Jun 17, 2026

CVE-2023-40309

CVE-2023-40309

Description

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

Affected products

49
  • SAP/Commoncryptolib2 versions
    cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:*
    • (no CPE)
  • SAP/Content Server3 versions
    cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:*
  • SAP/Extended Application Services And Runtime
    cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:*
  • SAP/Hana Database
    cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:*
  • SAP/Host Agent
    cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:*
  • SAP/NetWeaver Application Server for ABAP17 versions
    cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:*+ 16 more
    • cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:*
  • SAP/Netweaver Application Server Java16 versions
    cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:*+ 15 more
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:*
  • SAP/Sapssoext
    cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:*
  • SAP/Web Dispatcher6 versions
    cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*
  • SAP/Sap Extended Application Services And Runtime (xsa)v5
    Range: SAP_EXTENDED_APP_SERVICES 1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.