Vulnerability · Published Dec 12, 2023 · Assigned by sap
CVE-2023-50424Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)
Critical 9.1
In plain English
A critical-severity security flaw in github.com/sap/cloud-security-client-go from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/sap/cloud-security-client-go | 0.17.0 | GHSA-92cg-ghq6-9587 |
| Go | github.com/sap/cloud-security-client-go | 0.17.0 | GHSA-m8rw-rcpq-2vp2 |
| Go | github.com/sap/cloud-security-client-go | 0.17.0 | GO-2023-2400 |
| Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | 3.3.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:java-security | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:java-security | 3.3.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:spring-security | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:spring-security | 3.3.0 | GHSA-59c9-pxq8-9c73 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | github.com/sap/cloud-security-client-go | < 0.17.0 |
Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://me.sap.com/notes/3411067 vendor-advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://github.com/SAP/cloud-security-client-go
- https://pkg.go.dev/github.com/sap/cloud-security-client-go@v0.17.0
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 vendor-advisory