CVSS 3.1 Score 9.8 of 10 (high)


Published Sep 12, 2023
Updated: Sep 15, 2023
CWE ID 862


CVE-2023-40309 is a vulnerability in SAP CommonCryptoLib that could allow an authenticated user to escalate their privileges due to the lack of necessary authentication checks. This vulnerability affects various SAP products, including sCviz2, sVz1mC, t0KDsr, t0KDsq, t0KDsp, t0KDsv, tex_DA, t0KDsu, tex_DB, t0KDst, tex_DC, t0KDsy, t0KDsw, tzDcZg, j6yBpv, sE9wXM, tex_C9, sE9wXN, j6yBpx, oQunFC, j6yBpy, sE9wXO, tex_C-, tex_C_, sE9wXP, oQunFE,oQunFG,mNlpck,oQunFL,oQunFP,oQunEP. Depending on the level of privileges acquired by the attacker and the application being targeted, they could abuse functionality restricted to certain user groups and potentially read, modify or delete restricted data. The risk score for this vulnerability is 65 out of 100 and it has a base severity rating of CRITICAL. No user interaction or privileges are required for exploitation and the attack vector is through the network. The impact on confidentiality and integrity is rated as HIGH. It is recommended to apply appropriate patches or updates provided by SAP to remediate this vulnerability. Note: This summary is based on the provided information and does not include any additional analysis or opinions.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-40309 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options