CVE-2023-40309
Estado: ModificadaCrítica (9.8)—
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.88%
- Percentil entre todas las CVEs puntuadas: 58
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
CWE
- CWE-863
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-40309",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-40309",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-26T14:26:09.938156Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@sap.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cna@sap.com",
"affectedData": [
{
"vendor": "SAP_SE",
"product": "SAP CommonCryptoLib",
"versions": [
{
"status": "affected",
"version": "8"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "SAP_SE",
"product": "SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise",
"versions": [
{
"status": "affected",
"version": "KERNEL 7.22"
},
{
"status": "affected",
"version": "KERNEL 7.53"
},
{
"status": "affected",
"version": "KERNEL 7.54"
},
{
"status": "affected",
"version": "KERNEL 7.77"
},
{
"status": "affected",
"version": "KERNEL 7.85"
},
{
"status": "affected",
"version": "KERNEL 7.89"
},
{
"status": "affected",
"version": "KERNEL 7.91"
},
{
"status": "affected",
"version": "KERNEL 7.92"
},
{
"status": "affected",
"version": "KERNEL 7.93"
},
{
"status": "affected",
"version": "KERNEL 8.04"
},
{
"status": "affected",
"version": "KERNEL64UC 7.22"
},
{
"status": "affected",
"version": "KERNEL64UC 7.22EXT"
},
{
"status": "affected",
"version": "KERNEL64UC 7.53"
},
{
"status": "affected",
"version": "KERNEL64UC 8.04"
},
{
"status": "affected",
"version": "KERNEL64NUC 7.22"
},
{
"status": "affected",
"version": "KERNEL64NUC 7.22EXT"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "SAP_SE",
"product": "SAP Web Dispatcher",
"versions": [
{
"status": "affected",
"version": "7.22EXT"
},
{
"status": "affected",
"version": "7.53"
},
{
"status": "affected",
"version": "7.54"
},
{
"status": "affected",
"version": "7.77"
},
{
"status": "affected",
"version": "7.85"
},
{
"status": "affected",
"version": "7.89"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "SAP_SE",
"product": "SAP Content Server",
"versions": [
{
"status": "affected",
"version": "6.50"
},
{
"status": "affected",
"version": "7.53"
},
{
"status": "affected",
"version": "7.54"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "SAP_SE",
"product": "SAP HANA Database",
"versions": [
{
"status": "affected",
"version": "2.00"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "SAP_SE",
"product": "SAP Host Agent",
"versions": [
{
"status": "affected",
"version": "722"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "SAP_SE",
"product": "SAP Extended Application Services and Runtime (XSA)",
"versions": [
{
"status": "affected",
"version": "SAP_EXTENDED_APP_SERVICES 1"
},
{
"status": "affected",
"version": "XS_ADVANCED_RUNTIME 1.00"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "SAP_SE",
"product": "SAPSSOEXT",
"versions": [
{
"status": "affected",
"version": "17"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-09-12T03:15:12.073",
"references": [
{
"url": "https://me.sap.com/notes/3340576",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"tags": [
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://me.sap.com/notes/3340576",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@sap.com",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data."
},
{
"lang": "es",
"value": "SAP CommonCryptoLib no realiza las comprobaciones de autenticación necesarias, lo que puede dar como resultado comprobaciones de autorización faltantes o incorrectas para un usuario autenticado, lo que resulta en una escalada de privilegios. Según la aplicación y el nivel de privilegios adquiridos, un atacante podría abusar de la funcionalidad restringida a un grupo de usuarios concreto, así como leer, modificar o eliminar datos restringidos."
}
],
"lastModified": "2026-06-17T06:17:11.817",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:commoncryptolib:8.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92E07A81-F35C-4BF4-8AB4-E5B3C3D09487"
},
{
"criteria": "cpe:2.3:a:sap:content_server:6.50:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85520864-E99A-4576-847C-5E0EA1E6CEC5"
},
{
"criteria": "cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A02FB973-7FA0-4881-B912-27F4CFBDC673"
},
{
"criteria": "cpe:2.3:a:sap:content_server:7.54:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED7FD33E-6870-48EB-8695-67B9169D1808"
},
{
"criteria": "cpe:2.3:a:sap:extended_application_services_and_runtime:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FF475F4D-11D8-401A-BAB8-8A31E81CEEEB"
},
{
"criteria": "cpe:2.3:a:sap:hana_database:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30B0858F-6AE9-4163-B001-1481FD3AFF9F"
},
{
"criteria": "cpe:2.3:a:sap:host_agent:722:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A56308E-B097-49F3-8963-1F34E8716CD9"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF64539B-0DE2-4076-91B9-F03F4DDFAE2F"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C07042F-C47F-441E-AB32-B58A066909E2"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBC44C62-0BFD-4170-B094-C82DEA473938"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.54:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D99F18BB-B44E-48B5-BD7C-D20E40915268"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "208F59B2-7D79-4E0E-97DA-AEB9976C8EEA"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.85:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A120BC2E-92B2-404A-ADF6-F1AF512631E6"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.89:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56F63498-DAC3-40EE-9625-51FA522BA0DB"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.91:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06155DA1-7EDD-4EBA-8EBB-F7352F4EC7D2"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.92:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "104EE65A-202C-4F4E-B725-791A73687167"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.93:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0269C487-81F8-4240-BEF8-1A7C33864519"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "379FDFC8-947E-4D09-A9DD-4B3F7481F648"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7184F3A2-3408-4B7E-BEA6-BBF55909969F"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64nuc_7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB2D30A5-DB16-4CB7-8135-3CE106FA5477"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1657980-CBAC-41AC-A20E-18D7199EA244"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "771ED2D0-3BC5-4C36-BCEB-1A1C46667363"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F05534F-3D2B-4983-9CC1-3A8BC7D421C8"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:kernel64uc_8.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE19A598-2F90-4014-AC5B-352FBC154907"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97EDAAC4-4885-46CE-860A-DDF92FF205C4"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E53E262-A23E-4D99-B2D8-DDCBEED85EA2"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.54:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7E61257-B187-4A83-96BD-D53CE11061D7"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.77:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "34E0B493-0860-4074-A383-F9C2A06EA8E9"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.85:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D338B951-5C8F-4C14-931C-5F8AEA7F5924"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.89:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "525603B5-ADDC-4F58-B730-FC748A56D6E1"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.91:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA2270AE-437E-4FDE-9F53-690C0BCF9C2E"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.92:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD374580-7D80-4D7F-8D89-8F52F2DEA8D4"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_7.93:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59253D09-D58D-4013-8F29-2172C1B83AA8"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel_8.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21316691-9A18-4B41-915E-491225CEF966"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BB08C06-0E07-4317-B1AC-C1ECCF931E7A"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64nuc_7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8692B960-38A9-4035-88F5-C33D15B6A018"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D9E47FB-D39A-40C3-AEEE-D6A5AE27F063"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80C5A218-C623-41C5-A001-304046608CF9"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92E7B426-D50F-4AEE-B6F3-5D00C8A195F5"
},
{
"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:kernel64uc_8.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "039A11C9-D9D1-42BC-8DD4-2BCDAAF464CD"
},
{
"criteria": "cpe:2.3:a:sap:sapssoext:17.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "784CA842-6657-4A02-96B0-76A66AC469C9"
},
{
"criteria": "cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3F76E6A-2F27-450C-AAB5-E49A64079CAC"
},
{
"criteria": "cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47D4D542-2EC2-490B-B4E9-3E7BB8D59B77"
},
{
"criteria": "cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "950DF1E2-990E-41EF-8779-CEC54C7CDC60"
},
{
"criteria": "cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E33D9481-3CF6-4AA3-B115-7903AC6DAE25"
},
{
"criteria": "cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F74EE4D5-E968-4851-89E6-4152F64930F2"
},
{
"criteria": "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "097ED3E8-49B1-497E-BD43-28C397FBEAE8"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cna@sap.com"
}