CVEvulnerability
CVE-2023-50422
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-12-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-749
Description
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Affected configurations
• sap cloud-security-services-integration-library (< 2.17.0)
• sap cloud-security-services-integration-library (>= 3.0.0 < 3.3.0)
Related
Weakness · CWE (1)
- CWE-749 Exposed Dangerous Method or Function weakness
References
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ Vendor Advisory
- https://github.com/SAP/cloud-security-services-integration-library/ Product
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 Vendor Advisory
- https://me.sap.com/notes/3411067 Permissions Required
- https://me.sap.com/notes/3413475 me.sap.com
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa Product
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-security Product
- https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security Product
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ Vendor Advisory
- https://github.com/SAP/cloud-security-services-integration-library/ Product
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 Vendor Advisory
- https://me.sap.com/notes/3411067 Permissions Required
- https://me.sap.com/notes/3413475 me.sap.com
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa Product
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-security Product
- https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security Product
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory