CVE-2023-40308: sap commoncryptolib +8 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2023-40308

CVSS 7.5 · High EPSS 0,75%

Kerentanan Out-of-bounds Write pada sap commoncryptolib, sap content server +7 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.

Rincian

Terbit di NVD: 12 September 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 0,75% peluang dieksploitasi; lebih tinggi dari 53,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sap	commoncryptolib	Versi 8.0.0
sap	content server	Versi 6.50
sap	content server	Versi 7.53
sap	content server	Versi 7.54
sap	extended application services and runtime	Versi 1.0
sap	hana database	Versi 2.0
sap	host agent	Versi 722
sap	netweaver application server abap	Versi 7.22ext
sap	netweaver application server abap	Versi kernel_7.22
sap	netweaver application server abap	Versi kernel_7.53
sap	netweaver application server abap	Versi kernel_7.54
sap	netweaver application server abap	Versi kernel_7.77
sap	netweaver application server abap	Versi kernel_7.85
sap	netweaver application server abap	Versi kernel_7.89
sap	netweaver application server abap	Versi kernel_7.91
sap	netweaver application server abap	Versi kernel_7.92
sap	netweaver application server abap	Versi kernel_7.93
sap	netweaver application server abap	Versi kernel_8.04
sap	netweaver application server abap	Versi kernel64nuc_7.22
sap	netweaver application server abap	Versi kernel64nuc_7.22ext
sap	netweaver application server abap	Versi kernel64uc_7.22
sap	netweaver application server abap	Versi kernel64uc_7.22ext
sap	netweaver application server abap	Versi kernel64uc_7.53
sap	netweaver application server abap	Versi kernel64uc_8.04
sap	netweaver application server java	Versi kernel_7.22
sap	netweaver application server java	Versi kernel_7.53
sap	netweaver application server java	Versi kernel_7.54
sap	netweaver application server java	Versi kernel_7.77
sap	netweaver application server java	Versi kernel_7.85
sap	netweaver application server java	Versi kernel_7.89
sap	netweaver application server java	Versi kernel_7.91
sap	netweaver application server java	Versi kernel_7.92
sap	netweaver application server java	Versi kernel_7.93
sap	netweaver application server java	Versi kernel_8.04
sap	netweaver application server java	Versi kernel64nuc_7.22
sap	netweaver application server java	Versi kernel64nuc_7.22ext
sap	netweaver application server java	Versi kernel64uc_7.22
sap	netweaver application server java	Versi kernel64uc_7.22ext
sap	netweaver application server java	Versi kernel64uc_7.53
sap	netweaver application server java	Versi kernel64uc_8.04
sap	sapssoext	Versi 17.0
sap	web dispatcher	Versi 7.22ext
sap	web dispatcher	Versi 7.53
sap	web dispatcher	Versi 7.54
sap	web dispatcher	Versi 7.77
sap	web dispatcher	Versi 7.85
sap	web dispatcher	Versi 7.89

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://me.sap.com/notes/3327896 permissions required · advisory vendor
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.