CVE-2023-50422
criticalPriorität · verfolgen · 39EPSS 0.014 · 71. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (14)
Betroffene Produkte und Versionsbereiche.
- sap cloud-security-services-integration-library< 2.17.0nvdUScpe:2.3:a:sap:cloud-security-services-integration-library:*:*:*:*:*:*:*:*
- sap cloud-security-services-integration-library3.0.0 → 3.3.0nvdUScpe:2.3:a:sap:cloud-security-services-integration-library:*:*:*:*:*:*:*:*
- Go github.com/sap/cloud-security-client-go< 0.17.0osvUSpkg:golang/github.com/sap/cloud-security-client-go
- Maven com.sap.cloud.security.xsuaa:spring-xsuaa< 2.17.0osvUSpkg:maven/com.sap.cloud.security.xsuaa/spring-xsuaa
- Maven com.sap.cloud.security.xsuaa:spring-xsuaa3.0.0 → 3.3.0osvUSpkg:maven/com.sap.cloud.security.xsuaa/spring-xsuaa
- Maven com.sap.cloud.security:java-security< 2.17.0osvUSpkg:maven/com.sap.cloud.security/java-security
- Maven com.sap.cloud.security:java-security3.0.0 → 3.3.0osvUSpkg:maven/com.sap.cloud.security/java-security
- Maven com.sap.cloud.security:spring-security< 2.17.0osvUSpkg:maven/com.sap.cloud.security/spring-security
- Maven com.sap.cloud.security:spring-security3.0.0 → 3.3.0osvUSpkg:maven/com.sap.cloud.security/spring-security
Advisories (7)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-3103SAP Software: Mehrere SchwachstellenDeutsch2023-12-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen um seine Privilegien zu erhöhen, Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.
- WID-SEC-W-2024-0025SAP Patchday Januar 2024Deutsch2024-01-08csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in SAP-Software ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder Phishing- und Cross-Site-Scripting (XSS)-Angriffe durchzuführen.
- GHSA-59c9-pxq8-9c73Improper JWT Signature Validation in SAP Security Services Library 2023-12-13ghsa · osvUS
### Impact SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. ### Patches Upgrade to patched version >= 2.17.0 or >= 3.3.0 We always recommend to upgrade to the latest released version. ### Workarounds No workarounds ### References https://www.cve.org/CVERecord?id=CVE-2023-50422
- GHSA-92cg-ghq6-9587Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go2023-12-12ghsa · osvUS
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m8rw-rcpq-2vp2. This link is maintained to preserve external references. ## Original Description SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
- GHSA-m8rw-rcpq-2vp2Improper Privilege Management in github.com/sap/cloud-security-client-go2023-12-13ghsa · osvUS
### Impact SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. ### Patches Upgrade to patched version >= 0.17.0 We always recommend to upgrade to the latest released version. ### Workarounds No workarounds ### References https://www.cve.org/CVERecord?id=CVE-2023-50424
- CVE-2023-50424Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)2023-12-12vendor · osvUS
SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
- GO-2023-2400Escalation of privileges in github.com/sap/cloud-security-client-go2023-12-16vendor · osvUS
An unauthenticated attacker can obtain arbitrary permissions within the application under certain conditions.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (28)
Externe Belege — Patches, Meldungen, Analysen.
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-50422/cnnvd
- https://github.com/SAP/cloud-security-services-integration-library/cnnvd
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73cnnvd
- https://me.sap.com/notes/3411067cnnvd
- https://me.sap.com/notes/3413475cnnvd
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaacnnvd
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-securitycnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan