CVE-2023-40308highCWE-787

CVE-2023-40308: high-severity vulnerability in SAP_SE SAP CommonCryptoLib

Memory Corruption vulnerability in SAP CommonCryptoLib

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver AS ABAP+ Monitor SAP NetWeaver AS Java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
SAP_SE · SAP CommonCryptoLibSAP_SE · SAP Content ServerSAP_SE · SAP Extended Application Services and Runtime (XSA)SAP_SE · SAP HANA DatabaseSAP_SE · SAP Host AgentSAP_SE · SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premiseSAP_SE · SAPSSOEXTSAP_SE · SAP Web Dispatcher
Related CVEs — SAP_SE SAP CommonCryptoLib

In the same product, most dangerous first.

CVE-2023-40309CRITICALMissing Authorization check in SAP CommonCryptoLibEPSS 0.9%CVE-2025-42940HIGHMemory Corruption vulnerability in SAP CommonCryptoLibEPSS 0.5%