CVE-2023-49583

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Exposed Dangerous Method or Function pada @sap/xssec. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Rincian

Terbit di NVD

12 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-749: Exposed Dangerous Method or Function

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ advisory vendor
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor
• https://me.sap.com/notes/3411067 permissions required
• https://me.sap.com/notes/3412456
• https://me.sap.com/notes/3413475
• https://www.npmjs.com/package/@sap/xssec product