Improper Authentication in CommonCryptoLib - CVE-2023-40309

Vulnerability identifier: #VU80681

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40309

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in SAP CommonCryptoLib. A remote attacker can bypass authentication process and gain unauthorized access to the application.

CommonCryptoLib
SAP SSO EXT
SAP HANA Extended Application Services
SAP HANA
SAP Content Server
SAP NetWeaver AS JAVA
SAP Web Dispatcher Kernel
SAP NetWeaver AS ABAP
SAP Host Agent

Install updates from vendor's website.

• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html?september2023

• Multiple vulnerabilities in SAP CommonCryptoLib
• SAP NetWeaver AS ABAP and JAVA update for CommonCryptoLib
• SAP Web Dispatcher Kernel update for CommonCryptoLib
• SAP Content Server update for CommonCryptoLib
• SAP HANA Database update for CommonCryptoLib
• SAP Host Agent update for CommonCryptoLib
• SAP Extended Application Services and Runtime update for CommonCryptoLib
• SAP SSO EXT update for CommonCryptoLib