Memory Corruption vulnerability in SAP CommonCryptoLib
Priority MEDIUM 40CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00754 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP CommonCryptoLib | 8 | — | No fix listed | CNA |
| SAP | SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise | KERNEL 7.22; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KERNEL 7.92; KERNEL 7.93; KERNEL 8.04; KERNEL64UC 7.22; KERNEL64UC 7.22EXT; KERNEL64UC 7.53; KERNEL64UC 8.04; KERNEL64NUC 7.22; KERNEL64NUC 7.22EXT | — | No fix listed | CNA |
| SAP | SAP Web Dispatcher | 7.22EXT; 7.53; 7.54; 7.77; 7.85; 7.89 | — | No fix listed | CNA |
| SAP | SAP Content Server | 6.50; 7.53; 7.54 | — | No fix listed | CNA |
| SAP | SAP HANA Database | 2.00 | — | No fix listed | CNA |
| SAP | SAP Host Agent | 722 | — | No fix listed | CNA |
| SAP | SAP Extended Application Services and Runtime (XSA) | SAP_EXTENDED_APP_SERVICES 1; XS_ADVANCED_RUNTIME 1.00 | — | No fix listed | CNA |
| SAP | SAPSSOEXT | 17 | — | No fix listed | CNA |
- SAP CommonCryptoLib VendorSAP Affected 8 Fixed in — No fix listed CNA
- SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise VendorSAP Affected KERNEL 7.22; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KERNEL 7.92; KERNEL 7.93; KERNEL 8.04; KERNEL64UC 7.22; KERNEL64UC 7.22EXT; KERNEL64UC 7.53; KERNEL64UC 8.04; KERNEL64NUC 7.22; KERNEL64NUC 7.22EXT Fixed in — No fix listed CNA
- SAP Web Dispatcher VendorSAP Affected 7.22EXT; 7.53; 7.54; 7.77; 7.85; 7.89 Fixed in — No fix listed CNA
- SAP Content Server VendorSAP Affected 6.50; 7.53; 7.54 Fixed in — No fix listed CNA
- SAP HANA Database VendorSAP Affected 2.00 Fixed in — No fix listed CNA
- SAP Host Agent VendorSAP Affected 722 Fixed in — No fix listed CNA
- SAP Extended Application Services and Runtime (XSA) VendorSAP Affected SAP_EXTENDED_APP_SERVICES 1; XS_ADVANCED_RUNTIME 1.00 Fixed in — No fix listed CNA
- SAPSSOEXT VendorSAP Affected 17 Fixed in — No fix listed CNA
CPE configurations NVD · 47
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:* | 8.0.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:* | 6.50 | Vulnerable | SAP |
| cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:* | 7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:* | 722 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:* | kernel_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:* | kernel_7.53 | Vulnerable | SAP |
- cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·SAP
- cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:* Versions 6.50 Vulnerable ·SAP
- cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·SAP
- cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·SAP
- cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:* Versions 722 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
Show 37 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:* | kernel_7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:* | kernel_7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:* | kernel_7.85 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:* | kernel_7.89 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:* | kernel_7.91 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:* | kernel_7.92 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:* | kernel_7.93 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:* | kernel_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:* | kernel64nuc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:* | kernel64nuc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:* | kernel64uc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:* | kernel64uc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:* | kernel64uc_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:* | kernel64uc_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:* | kernel_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:* | kernel_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:* | kernel_7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:* | kernel_7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:* | kernel_7.85 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:* | kernel_7.89 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:* | kernel_7.91 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:* | kernel_7.92 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:* | kernel_7.93 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:* | kernel_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:* | kernel64nuc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:* | kernel64nuc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:* | kernel64uc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:* | kernel64uc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:* | kernel64uc_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:* | kernel64uc_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:* | 7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* | 7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:* | 7.85 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:* | 7.89 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:* Versions kernel_7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:* Versions kernel_7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:* Versions kernel_7.85 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:* Versions kernel_7.89 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:* Versions kernel_7.91 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:* Versions kernel_7.92 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:* Versions kernel_7.93 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:* Versions kernel64nuc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:* Versions kernel64nuc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:* Versions kernel64uc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:* Versions kernel64uc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:* Versions kernel64uc_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:* Versions kernel64uc_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:* Versions kernel_7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:* Versions kernel_7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:* Versions kernel_7.85 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:* Versions kernel_7.89 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:* Versions kernel_7.91 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:* Versions kernel_7.92 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:* Versions kernel_7.93 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:* Versions kernel64nuc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:* Versions kernel64nuc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:* Versions kernel64uc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:* Versions kernel64uc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:* Versions kernel64uc_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:* Versions kernel64uc_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:* Versions 7.85 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:* Versions 7.89 Vulnerable ·SAP
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40308
- 2026-10-03 Alias added: GHSA-qr3g-7vmg-24hh
References
More SAP Commoncryptolib vulnerabilities
- TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
- TI-2021-15855 NULL pointer dereference in SAP CommonCryptoLib CVSS 3.1HIGH 7.5
- TI-2014-07052 SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in… CVSS 2.0HIGH 7.5
Sources
- CVE-2023-40308 · CVE Program
- CVE-2023-40308 · NVD
- FIRST EPSS
- GHSA-qr3g-7vmg-24hh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences