SAP Note 3340576
Missing Authorization check in SAP CommonCryptoLib
CriticalCVSS 9.8SAP CommonCryptoLib
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
- CVE(s)
- CVE-2023-40309
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products and versions
- Product SAP CommonCryptoLib
Versions: 8
- Product SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise
Versions: KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT
- Product SAP Web Dispatcher
Versions: 7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89
- Product SAP Content Server
Versions: 6.50, 7.53, 7.54
- Product SAP HANA Database
Versions: 2.00
- Product SAP Host Agent
Versions: 722
- Product SAP Extended Application Services and Runtime (XSA)
Versions: SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00
- Product SAPSSOEXT
Versions: 17
Appears in
Patch Days listing this note, newest first.
- September 2023CriticalCVSS 9.8