CVE-2023-50422

Katalog CVE

CVSS 9.8 · Critical EPSS 1,4%

Kerentanan Exposed Dangerous Method or Function pada sap cloud-security-services-integration-library. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Rincian

Terbit di NVD

12 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-749: Exposed Dangerous Method or Function

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ advisory vendor
• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 advisory vendor
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor
• https://github.com/SAP/cloud-security-services-integration-library/ product
• https://me.sap.com/notes/3411067 permissions required
• https://me.sap.com/notes/3413475
• https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa product
• https://mvnrepository.com/artifact/com.sap.cloud.security/java-security product
• https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security product