Vulnerability Description
SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network, this causes the SAP application to crash and has high impact on the availability of the SAP system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Commoncryptolib | <= 8.5.38 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-DerThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2022/Jan/74Mailing ListMitigationThird Party Advisory
- https://launchpad.support.sap.com/#/notes/3051787Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405Vendor Advisory
- http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-DerThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2022/Jan/74Mailing ListMitigationThird Party Advisory
- https://launchpad.support.sap.com/#/notes/3051787Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405Vendor Advisory
FAQ
What is CVE-2021-38177?
CVE-2021-38177 is a vulnerability with a CVSS score of 7.5 (HIGH). SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network,...
How severe is CVE-2021-38177?
CVE-2021-38177 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-38177?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Commoncryptolib.