CVE-2023-40309

Summary

CVE-2023-40309 is a vulnerability in SAP CommonCryptoLib that could allow an authenticated user to escalate their privileges due to the lack of necessary authentication checks. This vulnerability affects various SAP products, including sCviz2, sVz1mC, t0KDsr, t0KDsq, t0KDsp, t0KDsv, tex_DA, t0KDsu, tex_DB, t0KDst, tex_DC, t0KDsy, t0KDsw, tzDcZg, j6yBpv, sE9wXM, tex_C9, sE9wXN, j6yBpx, oQunFC, j6yBpy, sE9wXO, tex_C-, tex_C_, sE9wXP, oQunFE,oQunFG,mNlpck,oQunFL,oQunFP,oQunEP. Depending on the level of privileges acquired by the attacker and the application being targeted, they could abuse functionality restricted to certain user groups and potentially read, modify or delete restricted data. The risk score for this vulnerability is 65 out of 100 and it has a base severity rating of CRITICAL. No user interaction or privileges are required for exploitation and the attack vector is through the network. The impact on confidentiality and integrity is rated as HIGH. It is recommended to apply appropriate patches or updates provided by SAP to remediate this vulnerability. Note: This summary is based on the provided information and does not include any additional analysis or opinions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.