Login Request a demo
High severity · published Sep 14, 2021
CVE-2021-38177
SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP…
7.5
CVSS
3.2%
EPSS
No
On KEV
Description
SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network, this causes the SAP application to crash and has high impact on the availability of the SAP system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Commoncryptolib · Sap
through 8.5.38 · source: NVD
Affected product
CO
Commoncryptolib
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-38177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-38177
Third Party Advisory
http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-Dereference.html
Mailing List
http://seclists.org/fulldisclosure/2022/Jan/74
Permissions Required
https://launchpad.support.sap.com/#/notes/3051787
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
More from Commoncryptolib
9.8
CVE-2023-40309
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation…
7.5
CVE-2023-40308
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes…
–
CVE-2014-8587
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature…