Vulnerability · Published Dec 12, 2023 · Assigned by sap
CVE-2023-50422Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)
Critical 9.1
In plain English
A critical-severity security flaw in cloud-security-services-integration-library from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/sap/cloud-security-client-go | 0.17.0 | GHSA-92cg-ghq6-9587 |
| Go | github.com/sap/cloud-security-client-go | 0.17.0 | GHSA-m8rw-rcpq-2vp2 |
| Go | github.com/sap/cloud-security-client-go | 0.17.0 | GO-2023-2400 |
| Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | 3.3.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:java-security | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:java-security | 3.3.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:spring-security | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:spring-security | 3.3.0 | GHSA-59c9-pxq8-9c73 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | cloud-security-services-integration-library | < 2.17.03.0.0 – before 3.3.0 |
Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://me.sap.com/notes/3411067 vendor-advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://github.com/SAP/cloud-security-services-integration-library/
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-security
- https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 vendor-advisory
- https://me.sap.com/notes/3413475