SAP Commoncryptolib vulnerabilities

4 CVEs affecting SAP Commoncryptolib, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-40309, published 2023-09-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-38177, published 2021-09-14. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the…
CVE-2014-8587, published 2014-11-04. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA)…
CVE-2023-40309, published 2023-09-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges.…
CVE-2023-40308, published 2023-09-12. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component…