CVE-2023-40309 - Vulnerability Details

Vendors	Products
Sap	Commoncryptolib Content Server Extended Application Services And Runtime Hana Database Host Agent Netweaver Application Server Abap Netweaver Application Server Java Sapssoext Web Dispatcher

Link	Providers
https://me.sap.com/notes/3340576
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Type	Values Removed	Values Added
Weaknesses	CWE-862

Type	Values Removed	Values Added
Description	SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.	SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
Weaknesses		CWE-863

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40309", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2023-08-14T07:36:04.796Z", "datePublished": "2023-09-12T02:21:19.058Z", "dateUpdated": "2024-09-28T22:10:46.845Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP CommonCryptoLib", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "8"}]}, {"defaultStatus": "unaffected", "product": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "KERNEL 7.53"}, {"status": "affected", "version": "KERNEL 7.54"}, {"status": "affected", "version": "KERNEL 7.77"}, {"status": "affected", "version": "KERNEL 7.85"}, {"status": "affected", "version": "KERNEL 7.89"}, {"status": "affected", "version": "KERNEL 7.91"}, {"status": "affected", "version": "KERNEL 7.92"}, {"status": "affected", "version": "KERNEL 7.93"}, {"status": "affected", "version": "KERNEL 8.04"}, {"status": "affected", "version": "KERNEL64UC 7.22"}, {"status": "affected", "version": "KERNEL64UC 7.22EXT"}, {"status": "affected", "version": "KERNEL64UC 7.53"}, {"status": "affected", "version": "KERNEL64UC 8.04"}, {"status": "affected", "version": "KERNEL64NUC 7.22"}, {"status": "affected", "version": "KERNEL64NUC 7.22EXT"}]}, {"defaultStatus": "unaffected", "product": "SAP Web Dispatcher", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.85"}, {"status": "affected", "version": "7.89"}]}, {"defaultStatus": "unaffected", "product": "SAP Content Server", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "6.50"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "7.54"}]}, {"defaultStatus": "unaffected", "product": "SAP HANA Database", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "2.00"}]}, {"defaultStatus": "unaffected", "product": "SAP Host Agent", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "722"}]}, {"defaultStatus": "unaffected", "product": "SAP Extended Application Services and Runtime (XSA)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SAP_EXTENDED_APP_SERVICES 1"}, {"status": "affected", "version": "XS_ADVANCED_RUNTIME 1.00"}]}, {"defaultStatus": "unaffected", "product": "SAPSSOEXT", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "17"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,\u00a0an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.</p>"}], "value": "SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,\u00a0an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-09-28T22:10:46.845Z"}, "references": [{"url": "https://me.sap.com/notes/3340576"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing Authorization check in SAP CommonCryptoLib", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:31:53.172Z"}, "title": "CVE Program Container", "references": [{"url": "https://me.sap.com/notes/3340576", "tags": ["x_transferred"]}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-26T14:26:09.938156Z", "id": "CVE-2023-40309", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T14:26:24.862Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-40309 (string)

assignerOrgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

state : PUBLISHED (string)

assignerShortName : sap (string)

dateReserved : 2023-08-14T07:36:04.796Z (string)

datePublished : 2023-09-12T02:21:19.058Z (string)

dateUpdated : 2024-09-28T22:10:46.845Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : SAP CommonCryptoLib (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 8 (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

product : SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : KERNEL 7.22 (string)

}

1 : { »

status : affected (string)

version : KERNEL 7.53 (string)

}

2 : { »

status : affected (string)

version : KERNEL 7.54 (string)

}

3 : { »

status : affected (string)

version : KERNEL 7.77 (string)

}

4 : { »

status : affected (string)

version : KERNEL 7.85 (string)

}

5 : { »

status : affected (string)

version : KERNEL 7.89 (string)

}

6 : { »

status : affected (string)

version : KERNEL 7.91 (string)

}

7 : { »

status : affected (string)

version : KERNEL 7.92 (string)

}

8 : { »

status : affected (string)

version : KERNEL 7.93 (string)

}

9 : { »

status : affected (string)

version : KERNEL 8.04 (string)

}

10 : { »

status : affected (string)

version : KERNEL64UC 7.22 (string)

}

11 : { »

status : affected (string)

version : KERNEL64UC 7.22EXT (string)

}

12 : { »

status : affected (string)

version : KERNEL64UC 7.53 (string)

}

13 : { »

status : affected (string)

version : KERNEL64UC 8.04 (string)

}

14 : { »

status : affected (string)

version : KERNEL64NUC 7.22 (string)

}

15 : { »

status : affected (string)

version : KERNEL64NUC 7.22EXT (string)

}

]

}

2 : { »

defaultStatus : unaffected (string)

product : SAP Web Dispatcher (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.22EXT (string)

}

1 : { »

status : affected (string)

version : 7.53 (string)

}

2 : { »

status : affected (string)

version : 7.54 (string)

}

3 : { »

status : affected (string)

version : 7.77 (string)

}

4 : { »

status : affected (string)

version : 7.85 (string)

}

5 : { »

status : affected (string)

version : 7.89 (string)

}

]

}

3 : { »

defaultStatus : unaffected (string)

product : SAP Content Server (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.50 (string)

}

1 : { »

status : affected (string)

version : 7.53 (string)

}

2 : { »

status : affected (string)

version : 7.54 (string)

}

]

}

4 : { »

defaultStatus : unaffected (string)

product : SAP HANA Database (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.00 (string)

}

]

}

5 : { »

defaultStatus : unaffected (string)

product : SAP Host Agent (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 722 (string)

}

]

}

6 : { »

defaultStatus : unaffected (string)

product : SAP Extended Application Services and Runtime (XSA) (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : SAP_EXTENDED_APP_SERVICES 1 (string)

}

1 : { »

status : affected (string)

version : XS_ADVANCED_RUNTIME 1.00 (string)

}

]

}

7 : { »

defaultStatus : unaffected (string)

product : SAPSSOEXT (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 17 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <p>SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.</p> (string)

}

]

value : SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

shortName : sap (string)

dateUpdated : 2024-09-28T22:10:46.845Z (string)

}

references : [ »

0 : { »

url : https://me.sap.com/notes/3340576 (string)

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Missing Authorization check in SAP CommonCryptoLib (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T18:31:53.172Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://me.sap.com/notes/3340576 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-26T14:26:09.938156Z (string)

id : CVE-2023-40309 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-26T14:26:24.862Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://me.sap.com/notes/3340576", "tags": ["x_transferred"]}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:31:53.172Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-40309", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-26T14:26:09.938156Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T14:26:19.817Z"}}], "cna": {"title": "Missing Authorization check in SAP CommonCryptoLib", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP CommonCryptoLib", "versions": [{"status": "affected", "version": "8"}], "defaultStatus": "unaffected"}, {"vendor": "SAP_SE", "product": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise", "versions": [{"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "KERNEL 7.53"}, {"status": "affected", "version": "KERNEL 7.54"}, {"status": "affected", "version": "KERNEL 7.77"}, {"status": "affected", "version": "KERNEL 7.85"}, {"status": "affected", "version": "KERNEL 7.89"}, {"status": "affected", "version": "KERNEL 7.91"}, {"status": "affected", "version": "KERNEL 7.92"}, {"status": "affected", "version": "KERNEL 7.93"}, {"status": "affected", "version": "KERNEL 8.04"}, {"status": "affected", "version": "KERNEL64UC 7.22"}, {"status": "affected", "version": "KERNEL64UC 7.22EXT"}, {"status": "affected", "version": "KERNEL64UC 7.53"}, {"status": "affected", "version": "KERNEL64UC 8.04"}, {"status": "affected", "version": "KERNEL64NUC 7.22"}, {"status": "affected", "version": "KERNEL64NUC 7.22EXT"}], "defaultStatus": "unaffected"}, {"vendor": "SAP_SE", "product": "SAP Web Dispatcher", "versions": [{"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.85"}, {"status": "affected", "version": "7.89"}], "defaultStatus": "unaffected"}, {"vendor": "SAP_SE", "product": "SAP Content Server", "versions": [{"status": "affected", "version": "6.50"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "7.54"}], "defaultStatus": "unaffected"}, {"vendor": "SAP_SE", "product": "SAP HANA Database", "versions": [{"status": "affected", "version": "2.00"}], "defaultStatus": "unaffected"}, {"vendor": "SAP_SE", "product": "SAP Host Agent", "versions": [{"status": "affected", "version": "722"}], "defaultStatus": "unaffected"}, {"vendor": "SAP_SE", "product": "SAP Extended Application Services and Runtime (XSA)", "versions": [{"status": "affected", "version": "SAP_EXTENDED_APP_SERVICES 1"}, {"status": "affected", "version": "XS_ADVANCED_RUNTIME 1.00"}], "defaultStatus": "unaffected"}, {"vendor": "SAP_SE", "product": "SAPSSOEXT", "versions": [{"status": "affected", "version": "17"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3340576"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,\u00a0an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,\u00a0an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-09-28T22:10:46.845Z"}}}, "cveMetadata": {"cveId": "CVE-2023-40309", "state": "PUBLISHED", "dateUpdated": "2024-09-28T22:10:46.845Z", "dateReserved": "2023-08-14T07:36:04.796Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2023-09-12T02:21:19.058Z", "assignerShortName": "sap"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://me.sap.com/notes/3340576 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T18:31:53.172Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-40309 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-26T14:26:09.938156Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-26T14:26:19.817Z (string)

}

]

cna : { »

title : Missing Authorization check in SAP CommonCryptoLib (string)

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 9.8 (number)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : SAP_SE (string)

product : SAP CommonCryptoLib (string)

versions : [ »

0 : { »

status : affected (string)

version : 8 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : SAP_SE (string)

product : SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise (string)

versions : [ »

0 : { »

status : affected (string)

version : KERNEL 7.22 (string)

}

1 : { »

status : affected (string)

version : KERNEL 7.53 (string)

}

2 : { »

status : affected (string)

version : KERNEL 7.54 (string)

}

3 : { »

status : affected (string)

version : KERNEL 7.77 (string)

}

4 : { »

status : affected (string)

version : KERNEL 7.85 (string)

}

5 : { »

status : affected (string)

version : KERNEL 7.89 (string)

}

6 : { »

status : affected (string)

version : KERNEL 7.91 (string)

}

7 : { »

status : affected (string)

version : KERNEL 7.92 (string)

}

8 : { »

status : affected (string)

version : KERNEL 7.93 (string)

}

9 : { »

status : affected (string)

version : KERNEL 8.04 (string)

}

10 : { »

status : affected (string)

version : KERNEL64UC 7.22 (string)

}

11 : { »

status : affected (string)

version : KERNEL64UC 7.22EXT (string)

}

12 : { »

status : affected (string)

version : KERNEL64UC 7.53 (string)

}

13 : { »

status : affected (string)

version : KERNEL64UC 8.04 (string)

}

14 : { »

status : affected (string)

version : KERNEL64NUC 7.22 (string)

}

15 : { »

status : affected (string)

version : KERNEL64NUC 7.22EXT (string)

}

]

defaultStatus : unaffected (string)

}

2 : { »

vendor : SAP_SE (string)

product : SAP Web Dispatcher (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.22EXT (string)

}

1 : { »

status : affected (string)

version : 7.53 (string)

}

2 : { »

status : affected (string)

version : 7.54 (string)

}

3 : { »

status : affected (string)

version : 7.77 (string)

}

4 : { »

status : affected (string)

version : 7.85 (string)

}

5 : { »

status : affected (string)

version : 7.89 (string)

}

]

defaultStatus : unaffected (string)

}

3 : { »

vendor : SAP_SE (string)

product : SAP Content Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.50 (string)

}

1 : { »

status : affected (string)

version : 7.53 (string)

}

2 : { »

status : affected (string)

version : 7.54 (string)

}

]

defaultStatus : unaffected (string)

}

4 : { »

vendor : SAP_SE (string)

product : SAP HANA Database (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.00 (string)

}

]

defaultStatus : unaffected (string)

}

5 : { »

vendor : SAP_SE (string)

product : SAP Host Agent (string)

versions : [ »

0 : { »

status : affected (string)

version : 722 (string)

}

]

defaultStatus : unaffected (string)

}

6 : { »

vendor : SAP_SE (string)

product : SAP Extended Application Services and Runtime (XSA) (string)

versions : [ »

0 : { »

status : affected (string)

version : SAP_EXTENDED_APP_SERVICES 1 (string)

}

1 : { »

status : affected (string)

version : XS_ADVANCED_RUNTIME 1.00 (string)

}

]

defaultStatus : unaffected (string)

}

7 : { »

vendor : SAP_SE (string)

product : SAPSSOEXT (string)

versions : [ »

0 : { »

status : affected (string)

version : 17 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://me.sap.com/notes/3340576 (string)

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : <p>SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

shortName : sap (string)

dateUpdated : 2024-09-28T22:10:46.845Z (string)

}

cveMetadata : { »

cveId : CVE-2023-40309 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-28T22:10:46.845Z (string)

dateReserved : 2023-08-14T07:36:04.796Z (string)

assignerOrgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

datePublished : 2023-09-12T02:21:19.058Z (string)

assignerShortName : sap (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "92E07A81-F35C-4BF4-8AB4-E5B3C3D09487", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:*", "matchCriteriaId": "85520864-E99A-4576-847C-5E0EA1E6CEC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*", "matchCriteriaId": "A02FB973-7FA0-4881-B912-27F4CFBDC673", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:*", "matchCriteriaId": "ED7FD33E-6870-48EB-8695-67B9169D1808", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "FF475F4D-11D8-401A-BAB8-8A31E81CEEEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "30B0858F-6AE9-4163-B001-1481FD3AFF9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:*", "matchCriteriaId": "6A56308E-B097-49F3-8963-1F34E8716CD9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:*", "matchCriteriaId": "AF64539B-0DE2-4076-91B9-F03F4DDFAE2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:*", "matchCriteriaId": "6C07042F-C47F-441E-AB32-B58A066909E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:*", "matchCriteriaId": "DBC44C62-0BFD-4170-B094-C82DEA473938", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:*", "matchCriteriaId": "D99F18BB-B44E-48B5-BD7C-D20E40915268", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:*", "matchCriteriaId": "208F59B2-7D79-4E0E-97DA-AEB9976C8EEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:*", "matchCriteriaId": "A120BC2E-92B2-404A-ADF6-F1AF512631E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:*", "matchCriteriaId": "56F63498-DAC3-40EE-9625-51FA522BA0DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:*", "matchCriteriaId": "06155DA1-7EDD-4EBA-8EBB-F7352F4EC7D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:*", "matchCriteriaId": "104EE65A-202C-4F4E-B725-791A73687167", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:*", "matchCriteriaId": "0269C487-81F8-4240-BEF8-1A7C33864519", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:*", "matchCriteriaId": "379FDFC8-947E-4D09-A9DD-4B3F7481F648", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:*", "matchCriteriaId": "7184F3A2-3408-4B7E-BEA6-BBF55909969F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:*", "matchCriteriaId": "BB2D30A5-DB16-4CB7-8135-3CE106FA5477", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:*", "matchCriteriaId": "D1657980-CBAC-41AC-A20E-18D7199EA244", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:*", "matchCriteriaId": "771ED2D0-3BC5-4C36-BCEB-1A1C46667363", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:*", "matchCriteriaId": "0F05534F-3D2B-4983-9CC1-3A8BC7D421C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:*", "matchCriteriaId": "AE19A598-2F90-4014-AC5B-352FBC154907", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:*", "matchCriteriaId": "97EDAAC4-4885-46CE-860A-DDF92FF205C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:*", "matchCriteriaId": "4E53E262-A23E-4D99-B2D8-DDCBEED85EA2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:*", "matchCriteriaId": "F7E61257-B187-4A83-96BD-D53CE11061D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:*", "matchCriteriaId": "34E0B493-0860-4074-A383-F9C2A06EA8E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:*", "matchCriteriaId": "D338B951-5C8F-4C14-931C-5F8AEA7F5924", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:*", "matchCriteriaId": "525603B5-ADDC-4F58-B730-FC748A56D6E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:*", "matchCriteriaId": "CA2270AE-437E-4FDE-9F53-690C0BCF9C2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:*", "matchCriteriaId": "BD374580-7D80-4D7F-8D89-8F52F2DEA8D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:*", "matchCriteriaId": "59253D09-D58D-4013-8F29-2172C1B83AA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:*", "matchCriteriaId": "21316691-9A18-4B41-915E-491225CEF966", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:*", "matchCriteriaId": "2BB08C06-0E07-4317-B1AC-C1ECCF931E7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:*", "matchCriteriaId": "8692B960-38A9-4035-88F5-C33D15B6A018", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:*", "matchCriteriaId": "1D9E47FB-D39A-40C3-AEEE-D6A5AE27F063", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:*", "matchCriteriaId": "80C5A218-C623-41C5-A001-304046608CF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:*", "matchCriteriaId": "92E7B426-D50F-4AEE-B6F3-5D00C8A195F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:*", "matchCriteriaId": "039A11C9-D9D1-42BC-8DD4-2BCDAAF464CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "784CA842-6657-4A02-96B0-76A66AC469C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*", "matchCriteriaId": "D3F76E6A-2F27-450C-AAB5-E49A64079CAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*", "matchCriteriaId": "47D4D542-2EC2-490B-B4E9-3E7BB8D59B77", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*", "matchCriteriaId": "950DF1E2-990E-41EF-8779-CEC54C7CDC60", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*", "matchCriteriaId": "E33D9481-3CF6-4AA3-B115-7903AC6DAE25", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*", "matchCriteriaId": "F74EE4D5-E968-4851-89E6-4152F64930F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*", "matchCriteriaId": "097ED3E8-49B1-497E-BD43-28C397FBEAE8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,\u00a0an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data."}, {"lang": "es", "value": "SAP CommonCryptoLib no realiza las comprobaciones de autenticaci\u00f3n necesarias, lo que puede dar como resultado comprobaciones de autorizaci\u00f3n faltantes o incorrectas para un usuario autenticado, lo que resulta en una escalada de privilegios. Seg\u00fan la aplicaci\u00f3n y el nivel de privilegios adquiridos, un atacante podr\u00eda abusar de la funcionalidad restringida a un grupo de usuarios concreto, as\u00ed como leer, modificar o eliminar datos restringidos."}], "id": "CVE-2023-40309", "lastModified": "2024-11-21T08:19:12.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cna@sap.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-12T03:15:12.073", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://me.sap.com/notes/3340576"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://me.sap.com/notes/3340576"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cna@sap.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 92E07A81-F35C-4BF4-8AB4-E5B3C3D09487 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:* (string)

matchCriteriaId : 85520864-E99A-4576-847C-5E0EA1E6CEC5 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:* (string)

matchCriteriaId : A02FB973-7FA0-4881-B912-27F4CFBDC673 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:* (string)

matchCriteriaId : ED7FD33E-6870-48EB-8695-67B9169D1808 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : FF475F4D-11D8-401A-BAB8-8A31E81CEEEB (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 30B0858F-6AE9-4163-B001-1481FD3AFF9F (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:* (string)

matchCriteriaId : 6A56308E-B097-49F3-8963-1F34E8716CD9 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:* (string)

matchCriteriaId : AF64539B-0DE2-4076-91B9-F03F4DDFAE2F (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:* (string)

matchCriteriaId : 6C07042F-C47F-441E-AB32-B58A066909E2 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:* (string)

matchCriteriaId : DBC44C62-0BFD-4170-B094-C82DEA473938 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:* (string)

matchCriteriaId : D99F18BB-B44E-48B5-BD7C-D20E40915268 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:* (string)

matchCriteriaId : 208F59B2-7D79-4E0E-97DA-AEB9976C8EEA (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:* (string)

matchCriteriaId : A120BC2E-92B2-404A-ADF6-F1AF512631E6 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:* (string)

matchCriteriaId : 56F63498-DAC3-40EE-9625-51FA522BA0DB (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:* (string)

matchCriteriaId : 06155DA1-7EDD-4EBA-8EBB-F7352F4EC7D2 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:* (string)

matchCriteriaId : 104EE65A-202C-4F4E-B725-791A73687167 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:* (string)

matchCriteriaId : 0269C487-81F8-4240-BEF8-1A7C33864519 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:* (string)

matchCriteriaId : 379FDFC8-947E-4D09-A9DD-4B3F7481F648 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:* (string)

matchCriteriaId : 7184F3A2-3408-4B7E-BEA6-BBF55909969F (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:* (string)

matchCriteriaId : BB2D30A5-DB16-4CB7-8135-3CE106FA5477 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:* (string)

matchCriteriaId : D1657980-CBAC-41AC-A20E-18D7199EA244 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:* (string)

matchCriteriaId : 771ED2D0-3BC5-4C36-BCEB-1A1C46667363 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:* (string)

matchCriteriaId : 0F05534F-3D2B-4983-9CC1-3A8BC7D421C8 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:* (string)

matchCriteriaId : AE19A598-2F90-4014-AC5B-352FBC154907 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:* (string)

matchCriteriaId : 97EDAAC4-4885-46CE-860A-DDF92FF205C4 (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E53E262-A23E-4D99-B2D8-DDCBEED85EA2 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:* (string)

matchCriteriaId : F7E61257-B187-4A83-96BD-D53CE11061D7 (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:* (string)

matchCriteriaId : 34E0B493-0860-4074-A383-F9C2A06EA8E9 (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:* (string)

matchCriteriaId : D338B951-5C8F-4C14-931C-5F8AEA7F5924 (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:* (string)

matchCriteriaId : 525603B5-ADDC-4F58-B730-FC748A56D6E1 (string)

vulnerable : true (boolean)

}

30 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:* (string)

matchCriteriaId : CA2270AE-437E-4FDE-9F53-690C0BCF9C2E (string)

vulnerable : true (boolean)

}

31 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:* (string)

matchCriteriaId : BD374580-7D80-4D7F-8D89-8F52F2DEA8D4 (string)

vulnerable : true (boolean)

}

32 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:* (string)

matchCriteriaId : 59253D09-D58D-4013-8F29-2172C1B83AA8 (string)

vulnerable : true (boolean)

}

33 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:* (string)

matchCriteriaId : 21316691-9A18-4B41-915E-491225CEF966 (string)

vulnerable : true (boolean)

}

34 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:* (string)

matchCriteriaId : 2BB08C06-0E07-4317-B1AC-C1ECCF931E7A (string)

vulnerable : true (boolean)

}

35 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:* (string)

matchCriteriaId : 8692B960-38A9-4035-88F5-C33D15B6A018 (string)

vulnerable : true (boolean)

}

36 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:* (string)

matchCriteriaId : 1D9E47FB-D39A-40C3-AEEE-D6A5AE27F063 (string)

vulnerable : true (boolean)

}

37 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:* (string)

matchCriteriaId : 80C5A218-C623-41C5-A001-304046608CF9 (string)

vulnerable : true (boolean)

}

38 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:* (string)

matchCriteriaId : 92E7B426-D50F-4AEE-B6F3-5D00C8A195F5 (string)

vulnerable : true (boolean)

}

39 : { »

criteria : cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:* (string)

matchCriteriaId : 039A11C9-D9D1-42BC-8DD4-2BCDAAF464CD (string)

vulnerable : true (boolean)

}

40 : { »

criteria : cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 784CA842-6657-4A02-96B0-76A66AC469C9 (string)

vulnerable : true (boolean)

}

41 : { »

criteria : cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* (string)

matchCriteriaId : D3F76E6A-2F27-450C-AAB5-E49A64079CAC (string)

vulnerable : true (boolean)

}

42 : { »

criteria : cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* (string)

matchCriteriaId : 47D4D542-2EC2-490B-B4E9-3E7BB8D59B77 (string)

vulnerable : true (boolean)

}

43 : { »

criteria : cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:* (string)

matchCriteriaId : 950DF1E2-990E-41EF-8779-CEC54C7CDC60 (string)

vulnerable : true (boolean)

}

44 : { »

criteria : cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* (string)

matchCriteriaId : E33D9481-3CF6-4AA3-B115-7903AC6DAE25 (string)

vulnerable : true (boolean)

}

45 : { »

criteria : cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:* (string)

matchCriteriaId : F74EE4D5-E968-4851-89E6-4152F64930F2 (string)

vulnerable : true (boolean)

}

46 : { »

criteria : cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:* (string)

matchCriteriaId : 097ED3E8-49B1-497E-BD43-28C397FBEAE8 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data. (string)

}

1 : { »

lang : es (string)

value : SAP CommonCryptoLib no realiza las comprobaciones de autenticación necesarias, lo que puede dar como resultado comprobaciones de autorización faltantes o incorrectas para un usuario autenticado, lo que resulta en una escalada de privilegios. Según la aplicación y el nivel de privilegios adquiridos, un atacante podría abusar de la funcionalidad restringida a un grupo de usuarios concreto, así como leer, modificar o eliminar datos restringidos. (string)

}

]

id : CVE-2023-40309 (string)

lastModified : 2024-11-21T08:19:12.560 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : cna@sap.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-09-12T03:15:12.073 (string)

references : [ »

0 : { »

source : cna@sap.com (string)

tags : [ »

0 : Permissions Required (string)

1 : Vendor Advisory (string)

]

url : https://me.sap.com/notes/3340576 (string)

}

1 : { »

source : cna@sap.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

1 : Vendor Advisory (string)

]

url : https://me.sap.com/notes/3340576 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

]

sourceIdentifier : cna@sap.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : cna@sap.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object