CVE-2023-50423

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Exposed Dangerous Method or Function pada sap-xssec. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Rincian

Terbit di NVD

12 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-749: Exposed Dangerous Method or Function

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ advisory vendor
• https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5 advisory vendor
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor
• https://github.com/SAP/cloud-pysec/ product
• https://me.sap.com/notes/3411067 permissions required
• https://pypi.org/project/sap-xssec/ product