Missing Authorization check in SAP CommonCryptoLib
Priority MEDIUM 50CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00875 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP CommonCryptoLib | 8 | — | No fix listed | CNA |
| SAP | SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise | KERNEL 7.22; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KERNEL 7.92; KERNEL 7.93; KERNEL 8.04; KERNEL64UC 7.22; KERNEL64UC 7.22EXT; KERNEL64UC 7.53; KERNEL64UC 8.04; KERNEL64NUC 7.22; KERNEL64NUC 7.22EXT | — | No fix listed | CNA |
| SAP | SAP Web Dispatcher | 7.22EXT; 7.53; 7.54; 7.77; 7.85; 7.89 | — | No fix listed | CNA |
| SAP | SAP Content Server | 6.50; 7.53; 7.54 | — | No fix listed | CNA |
| SAP | SAP HANA Database | 2.00 | — | No fix listed | CNA |
| SAP | SAP Host Agent | 722 | — | No fix listed | CNA |
| SAP | SAP Extended Application Services and Runtime (XSA) | SAP_EXTENDED_APP_SERVICES 1; XS_ADVANCED_RUNTIME 1.00 | — | No fix listed | CNA |
| SAP | SAPSSOEXT | 17 | — | No fix listed | CNA |
- SAP CommonCryptoLib VendorSAP Affected 8 Fixed in — No fix listed CNA
- SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise VendorSAP Affected KERNEL 7.22; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KERNEL 7.92; KERNEL 7.93; KERNEL 8.04; KERNEL64UC 7.22; KERNEL64UC 7.22EXT; KERNEL64UC 7.53; KERNEL64UC 8.04; KERNEL64NUC 7.22; KERNEL64NUC 7.22EXT Fixed in — No fix listed CNA
- SAP Web Dispatcher VendorSAP Affected 7.22EXT; 7.53; 7.54; 7.77; 7.85; 7.89 Fixed in — No fix listed CNA
- SAP Content Server VendorSAP Affected 6.50; 7.53; 7.54 Fixed in — No fix listed CNA
- SAP HANA Database VendorSAP Affected 2.00 Fixed in — No fix listed CNA
- SAP Host Agent VendorSAP Affected 722 Fixed in — No fix listed CNA
- SAP Extended Application Services and Runtime (XSA) VendorSAP Affected SAP_EXTENDED_APP_SERVICES 1; XS_ADVANCED_RUNTIME 1.00 Fixed in — No fix listed CNA
- SAPSSOEXT VendorSAP Affected 17 Fixed in — No fix listed CNA
CPE configurations NVD · 47
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:* | 8.0.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:* | 6.50 | Vulnerable | SAP |
| cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:* | 7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:* | 722 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:* | kernel_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:* | kernel_7.53 | Vulnerable | SAP |
- cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·SAP
- cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:* Versions 6.50 Vulnerable ·SAP
- cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·SAP
- cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·SAP
- cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:* Versions 722 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
Show 37 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:* | kernel_7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:* | kernel_7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:* | kernel_7.85 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:* | kernel_7.89 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:* | kernel_7.91 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:* | kernel_7.92 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:* | kernel_7.93 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:* | kernel_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:* | kernel64nuc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:* | kernel64nuc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:* | kernel64uc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:* | kernel64uc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:* | kernel64uc_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:* | kernel64uc_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:* | kernel_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:* | kernel_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:* | kernel_7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:* | kernel_7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:* | kernel_7.85 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:* | kernel_7.89 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:* | kernel_7.91 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:* | kernel_7.92 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:* | kernel_7.93 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:* | kernel_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:* | kernel64nuc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:* | kernel64nuc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:* | kernel64uc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:* | kernel64uc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:* | kernel64uc_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:* | kernel64uc_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:* | 7.54 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* | 7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:* | 7.85 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:* | 7.89 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:* Versions kernel_7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:* Versions kernel_7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:* Versions kernel_7.85 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:* Versions kernel_7.89 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:* Versions kernel_7.91 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:* Versions kernel_7.92 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:* Versions kernel_7.93 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:* Versions kernel64nuc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:* Versions kernel64nuc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:* Versions kernel64uc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:* Versions kernel64uc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:* Versions kernel64uc_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:* Versions kernel64uc_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:* Versions kernel_7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:* Versions kernel_7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:* Versions kernel_7.85 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:* Versions kernel_7.89 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:* Versions kernel_7.91 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:* Versions kernel_7.92 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:* Versions kernel_7.93 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:* Versions kernel64nuc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:* Versions kernel64nuc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:* Versions kernel64uc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:* Versions kernel64uc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:* Versions kernel64uc_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:* Versions kernel64uc_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:* Versions 7.85 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:* Versions 7.89 Vulnerable ·SAP
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40309
- 2026-10-03 Alias added: GHSA-42qx-rv8j-r8f3
References
More SAP Commoncryptolib vulnerabilities
- TI-2023-21148 Memory Corruption vulnerability in SAP CommonCryptoLib CVSS 3.1HIGH 7.5
- TI-2021-15855 NULL pointer dereference in SAP CommonCryptoLib CVSS 3.1HIGH 7.5
- TI-2014-07052 SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in… CVSS 2.0HIGH 7.5
Sources
- CVE-2023-40309 · CVE Program
- CVE-2023-40309 · NVD
- FIRST EPSS
- GHSA-42qx-rv8j-r8f3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences