Cyber Resilience

CVE-2023-40308

High

Published: 12 September 2023

Published
12 September 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0016 37.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-40308 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Sap Netweaver Application Server Abap. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 37.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no…

more

ability to view or modify any information.

CWE(s)
CWE-787

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

sap
commoncryptolib
8.0.0
sap
content server
6.50, 7.53, 7.54
sap
extended application services and runtime
1.0
sap
hana database
2.0
sap
host agent
722
sap
netweaver application server abap
7.22ext, kernel64nuc_7.22, kernel64nuc_7.22ext, kernel64uc_7.22, kernel64uc_7.22ext
sap
netweaver application server java
kernel64nuc_7.22, kernel64nuc_7.22ext, kernel64uc_7.22, kernel64uc_7.22ext, kernel64uc_7.53
sap
sapssoext
17.0
sap
web dispatcher
7.22ext, 7.53, 7.54, 7.77, 7.85

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-16 Memory Protection
addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References