GitHub Advisoryadvisory · npm

GHSA-p2vx-qj66-88q3 Escalation of privileges in @sap/xssec

CRITICAL Published 2023-12-12 Modified 2024-09-30 Official page ↗
Aliases
CVE-2023-49583
Ecosystem
npm
Packages
@sap/xssec
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-269, CWE-639, CWE-749
Reviewed
2023-12-20

Affected packages

• npm @sap/xssec: < 3.6.0 → fixed in 3.6.0

Description

SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Related

Alias · CVE (1)

  • CVE-2023-49583 SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of… vulnerability

Weakness · CWE (3)

  • CWE-269 Improper Privilege Management weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-749 Exposed Dangerous Method or Function weakness

References