CVE-2023-40309

CWE-863 — Incorrect AuthorizationCWE-862 — Missing Authorization3 documents3 sources
Severity
9.8CRITICAL
EPSS
0.2%
top 62.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
16
SAP SE SAP CommoncryptolibSAP SE SAP Content ServerSAP SE SAP Extended Application Services AND Runtime (xsa)+13 more
Timeline
PublishedSep 12
Latest updateSep 15

Description

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages15 packages

▶CVEListV5sap_se/sap_hana_database2.00
▶NVDsap/netweaver_application17 versions+16

🔴Vulnerability Details

2
GHSA
GHSA-42qx-rv8j-r8f3: SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated u↗2023-09-15
▶
CVEList
Missing Authorization check in SAP CommonCryptoLib↗2023-09-12
▶
CVE-2023-40309 (CRITICAL CVSS 9.8) | SAP CommonCryptoLib does not perfor | cvebase.io