Vulnerability · Published Dec 12, 2023 · Assigned by sap
CVE-2023-49583Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)
Critical 9.1
In plain English
A critical-severity security flaw in @sap/xssec from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.1%top 34.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @sap/xssec | 3.6.0 | GHSA-p2vx-qj66-88q3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | @sap/xssec | < 3.6.0 |
Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://me.sap.com/notes/3411067 vendor-advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://www.npmjs.com/package/@sap/xssec
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://me.sap.com/notes/3412456
- https://me.sap.com/notes/3413475