GCVE - cpe:2.3:a:sap_se:sap_commoncryptolib:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sap_se:sap_commoncryptolib:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Sap Se (`f8f3f5db-c060-5230-a8bd-f91674203607`)
Product	Sap Commoncryptolib (`83a8e570-6ceb-5435-a7f5-55c46a0db5b2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-42940`	vulnerable	2026-06-08 07:25:08.442248	Memory Corruption vulnerability in SAP CommonCryptoLib HIGH (7.5) SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network. This may result in memory corruption followed by an application crash, hence leading to a high impact on availability. There is no impact on confidentiality or integrity. Published: 2025-11-11T00:20:44.455Z Updated: 2025-11-12T20:09:31.961Z Open on db.gcve.eu Reference links https://me.sap.com/notes/3633049 https://url.sap/sapsecuritypatchday	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-40309`	vulnerable	2026-06-08 06:09:42.051530	Missing Authorization check in SAP CommonCryptoLib CRITICAL (9.8) SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data. Published: 2023-09-12T02:21:19.058Z Updated: 2024-09-28T22:10:46.845Z Open on db.gcve.eu Reference links https://me.sap.com/notes/3340576 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-40308`	vulnerable	2026-06-08 06:09:42.005157	Memory Corruption vulnerability in SAP CommonCryptoLib HIGH (7.5) SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information. Published: 2023-09-12T01:21:15.083Z Updated: 2024-09-26T18:22:53.534Z Open on db.gcve.eu Reference links https://me.sap.com/notes/3327896 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-38177`	vulnerable	2026-06-08 05:32:55.624772	Details available HIGH (7.5) SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network, this causes the SAP application to crash and has high impact on the availability of the SAP system. Published: 2021-09-14T11:24:27.000Z Updated: 2024-08-04T01:37:16.323Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 https://launchpad.support.sap.com/#/notes/3051787 http://seclists.org/fulldisclosure/2022/Jan/74 http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-Dereference.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.