CVE-2023-40309

sap commoncryptolib, sap content server, sap extended application services and runtime +6 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-40309

Katalog CVE

CVSS 9.8 · Critical EPSS 0,88%

Kerentanan Incorrect Authorization pada sap commoncryptolib, sap content server +7 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

Rincian

Terbit di NVD
12 September 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-863: Incorrect Authorization
EPSS (30 hari)
0,88% peluang dieksploitasi; lebih tinggi dari 57,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
sap commoncryptolib Versi 8.0.0
sap content server Versi 6.50
sap content server Versi 7.53
sap content server Versi 7.54
sap extended application services and runtime Versi 1.0
sap hana database Versi 2.0
sap host agent Versi 722
sap netweaver application server abap Versi 7.22ext
sap netweaver application server abap Versi kernel_7.22
sap netweaver application server abap Versi kernel_7.53
sap netweaver application server abap Versi kernel_7.54
sap netweaver application server abap Versi kernel_7.77
sap netweaver application server abap Versi kernel_7.85
sap netweaver application server abap Versi kernel_7.89
sap netweaver application server abap Versi kernel_7.91
sap netweaver application server abap Versi kernel_7.92
sap netweaver application server abap Versi kernel_7.93
sap netweaver application server abap Versi kernel_8.04
sap netweaver application server abap Versi kernel64nuc_7.22
sap netweaver application server abap Versi kernel64nuc_7.22ext
sap netweaver application server abap Versi kernel64uc_7.22
sap netweaver application server abap Versi kernel64uc_7.22ext
sap netweaver application server abap Versi kernel64uc_7.53
sap netweaver application server abap Versi kernel64uc_8.04
sap netweaver application server java Versi kernel_7.22
sap netweaver application server java Versi kernel_7.53
sap netweaver application server java Versi kernel_7.54
sap netweaver application server java Versi kernel_7.77
sap netweaver application server java Versi kernel_7.85
sap netweaver application server java Versi kernel_7.89
sap netweaver application server java Versi kernel_7.91
sap netweaver application server java Versi kernel_7.92
sap netweaver application server java Versi kernel_7.93
sap netweaver application server java Versi kernel_8.04
sap netweaver application server java Versi kernel64nuc_7.22
sap netweaver application server java Versi kernel64nuc_7.22ext
sap netweaver application server java Versi kernel64uc_7.22
sap netweaver application server java Versi kernel64uc_7.22ext
sap netweaver application server java Versi kernel64uc_7.53
sap netweaver application server java Versi kernel64uc_8.04
sap sapssoext Versi 17.0
sap web dispatcher Versi 7.22ext
sap web dispatcher Versi 7.53
sap web dispatcher Versi 7.54
sap web dispatcher Versi 7.77
sap web dispatcher Versi 7.85
sap web dispatcher Versi 7.89

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.