Vulnerability Description
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Commoncryptolib | 8.0.0 |
| Sap | Content Server | 6.50 |
| Sap | Extended Application Services And Runtime | 1.0 |
| Sap | Hana Database | 2.0 |
| Sap | Host Agent | 722 |
| Sap | Netweaver Application Server Abap | 7.22ext |
| Sap | Netweaver Application Server Java | kernel_7.22 |
| Sap | Sapssoext | 17.0 |
| Sap | Web Dispatcher | 7.22ext |
Related Weaknesses (CWE)
References
- https://me.sap.com/notes/3327896Permissions RequiredVendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
- https://me.sap.com/notes/3327896Permissions RequiredVendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
FAQ
What is CVE-2023-40308?
CVE-2023-40308 is a vulnerability with a CVSS score of 7.5 (HIGH). SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component ...
How severe is CVE-2023-40308?
CVE-2023-40308 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-40308?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Commoncryptolib, Sap Content Server, Sap Extended Application Services And Runtime, Sap Hana Database, Sap Host Agent.