CVE-2021-38177

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-14 · updated 2026-06-17
Weakness: CWE-476

Description

SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network, this causes the SAP application to crash and has high impact on the availability of the SAP system.

Affected products

SAP_SE SAP CommonCryptoLib: through 8.5.38

References

http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-Dereference.html
http://seclists.org/fulldisclosure/2022/Jan/74
https://launchpad.support.sap.com/#/notes/3051787
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-Dereference.html
http://seclists.org/fulldisclosure/2022/Jan/74
https://launchpad.support.sap.com/#/notes/3051787
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405

Get alerted when CVE-2021-38177 or the next vulnerability affects your stack