title: Missing Authorization check in SAP CommonCryptoLib
description: SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
problem types: CWE-862: Missing Authorization
affected:
{
defaultStatus: unaffected
product: SAP CommonCryptoLib
vendor: SAP_SE
versions:
status: affected, version: 8
}
{
defaultStatus: unaffected
product: SAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise
vendor: SAP_SE
versions:
status: affected, version: KERNEL 7.22
status: affected, version: KERNEL 7.53
status: affected, version: KERNEL 7.54
status: affected, version: KERNEL 7.77
status: affected, version: KERNEL 7.85
status: affected, version: KERNEL 7.89
status: affected, version: KERNEL 7.91
status: affected, version: KERNEL 7.92
status: affected, version: KERNEL 7.93
status: affected, version: KERNEL 8.04
status: affected, version: KERNEL64UC 7.22
status: affected, version: KERNEL64UC 7.22EXT
status: affected, version: KERNEL64UC 7.53
status: affected, version: KERNEL64UC 8.04
status: affected, version: KERNEL64NUC 7.22
status: affected, version: KERNEL64NUC 7.22EXT
}
{
defaultStatus: unaffected
product: SAP Web Dispatcher
vendor: SAP_SE
versions:
status: affected, version: 7.22EXT
status: affected, version: 7.53
status: affected, version: 7.54
status: affected, version: 7.77
status: affected, version: 7.85
status: affected, version: 7.89
}
{
defaultStatus: unaffected
product: SAP Content Server
vendor: SAP_SE
versions:
status: affected, version: 6.50
status: affected, version: 7.53
status: affected, version: 7.54
}
{
defaultStatus: unaffected
product: SAP HANA Database
vendor: SAP_SE
versions:
status: affected, version: 2.00
}
{
defaultStatus: unaffected
product: SAP Host Agent
vendor: SAP_SE
versions:
status: affected, version: 722
}
{
defaultStatus: unaffected
product: SAP Extended Application Services and Runtime (XSA)
vendor: SAP_SE
versions:
status: affected, version: SAP_EXTENDED_APP_SERVICES 1
status: affected, version: XS_ADVANCED_RUNTIME 1.00
}
{
defaultStatus: unaffected
product: SAPSSOEXT
vendor: SAP_SE
versions:
status: affected, version: 17
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL