CVE-2023-40308

HIGH

SAP CommonCryptoLib - Unauthenticated Denial of Service via Memory Corruption

Title source: llm

Description

SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.

References (2)

Core 2

Core References

Permissions Required, Vendor Advisory

https://me.sap.com/notes/3327896

Vendor Advisory

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Scores

CVSS v3 7.5

EPSS 0.0013

EPSS Percentile 32.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-787

Status published

Products (47)

sap/commoncryptolib 8.0.0

sap/content_server 6.50

sap/content_server 7.53

sap/content_server 7.54

sap/extended_application_services_and_runtime 1.0

sap/hana_database 2.0

sap/host_agent 722

sap/netweaver_application_server_abap 7.22ext

sap/netweaver_application_server_abap kernel_7.22

sap/netweaver_application_server_abap kernel_7.53

... and 37 more

Published Sep 12, 2023

Tracked Since Feb 18, 2026