CVE-2023-40309 CRITICAL

CVE-2023-40309: Missing Authorization check in SAP CommonCryptoLib

Vendor Sap_Se
Product SAP CommonCryptoLib
Weakness CWE-863 · Incorrect authorization
Published September 12, 2023
Last update September 28, 2024

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

Key dates

02Disclosure timeline

September 12, 2023 CVE published
September 28, 2024 Record updated