7.5

CVE-2023-40308

SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.

Data is provided by the National Vulnerability Database (NVD)
SAP ≫ Commoncryptolib Version8.0.0
SAP ≫ Content Server Version6.50
SAP ≫ Content Server Version7.53
SAP ≫ Content Server Version7.54
SAP ≫ Hana Database Version2.0
SAP ≫ Host Agent Version722
SAP ≫ Netweaver Application Server Abap Versionkernel_7.22
SAP ≫ Netweaver Application Server Abap Versionkernel_7.53
SAP ≫ Netweaver Application Server Abap Versionkernel_7.54
SAP ≫ Netweaver Application Server Abap Versionkernel_7.77
SAP ≫ Netweaver Application Server Abap Versionkernel_7.85
SAP ≫ Netweaver Application Server Abap Versionkernel_7.89
SAP ≫ Netweaver Application Server Abap Versionkernel_7.91
SAP ≫ Netweaver Application Server Abap Versionkernel_7.92
SAP ≫ Netweaver Application Server Abap Versionkernel_7.93
SAP ≫ Netweaver Application Server Abap Versionkernel_8.04
SAP ≫ Netweaver Application Server Abap Versionkernel64nuc_7.22
SAP ≫ Netweaver Application Server Abap Versionkernel64nuc_7.22ext
SAP ≫ Netweaver Application Server Abap Versionkernel64uc_7.22
SAP ≫ Netweaver Application Server Abap Versionkernel64uc_7.22ext
SAP ≫ Netweaver Application Server Abap Versionkernel64uc_7.53
SAP ≫ Netweaver Application Server Abap Versionkernel64uc_8.04
SAP ≫ Netweaver Application Server Java Versionkernel_7.22
SAP ≫ Netweaver Application Server Java Versionkernel_7.53
SAP ≫ Netweaver Application Server Java Versionkernel_7.54
SAP ≫ Netweaver Application Server Java Versionkernel_7.77
SAP ≫ Netweaver Application Server Java Versionkernel_7.85
SAP ≫ Netweaver Application Server Java Versionkernel_7.89
SAP ≫ Netweaver Application Server Java Versionkernel_7.91
SAP ≫ Netweaver Application Server Java Versionkernel_7.92
SAP ≫ Netweaver Application Server Java Versionkernel_7.93
SAP ≫ Netweaver Application Server Java Versionkernel_8.04
SAP ≫ Netweaver Application Server Java Versionkernel64nuc_7.22
SAP ≫ Netweaver Application Server Java Versionkernel64nuc_7.22ext
SAP ≫ Netweaver Application Server Java Versionkernel64uc_7.22
SAP ≫ Netweaver Application Server Java Versionkernel64uc_7.22ext
SAP ≫ Netweaver Application Server Java Versionkernel64uc_7.53
SAP ≫ Netweaver Application Server Java Versionkernel64uc_8.04
SAP ≫ Sapssoext Version17.0
SAP ≫ Web Dispatcher Version7.22ext
SAP ≫ Web Dispatcher Version7.53
SAP ≫ Web Dispatcher Version7.54
SAP ≫ Web Dispatcher Version7.77
SAP ≫ Web Dispatcher Version7.85
SAP ≫ Web Dispatcher Version7.89
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.13% 0.339
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cna@sap.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://me.sap.com/notes/3327896
Vendor Advisory
Permissions Required