by Kastro
Paper/Archive/CVE-2023-50422

CVE-2023-50422

SAP_SE cloud-security-services-integration-library — Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.6.716 × 2014.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Affected

ProductAffectedFixed inSource
cloud-security-services-integration-library< 2.17.0–CNA
cloud-security-services-integration-library3.0.0 – < 3.3.03.3.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryme.sap.com/notes/3411067refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlrefgithub.com/SAP/cloud-security-services-integration-libraryrefmvnrepository.com/artifact/com.sap.cloud.security/java-securityrefmvnrepository.com/artifact/com.sap.cloud.security/spring-securityrefmvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaarefblogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067advisorygithub.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73refme.sap.com/notes/3413475