PT-2023-7890 · Sap · Sap Btp Security Services Integration Library

Rosenblueh · Publicado 2023-12-11 · Atualizado 2024-09-28 · CVE-2023-50422

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP BTP Security Services Integration Library versions below 2.17.0 SAP BTP Security Services Integration Library versions from 3.0.0 to before 3.3.0

Description The issue is related to insecure privilege management in the SAP BTP Security Services Integration Library, allowing an unauthenticated attacker to obtain arbitrary permissions within the application under certain conditions. On successful exploitation, this can lead to an escalation of privileges.

Recommendations For versions below 2.17.0, upgrade to version 2.17.0 or later. For versions from 3.0.0 to before 3.3.0, upgrade to version 3.3.0 or later. It is recommended to upgrade to the latest released version to ensure all security patches are applied.

Correção

IDOR

Improper Privilege Management

Enumeração de Fraquezas

CWE-639

CWE-749

CWE-269

Identificadores relacionados

BDU:2023-08961

CVE-2023-50422

GHSA-59C9-PXQ8-9C73

GHSA-GCGW-Q47M-PRVJ

Produtos afetados

Sap Btp Security Services Integration Library

Referências · 21

• https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360 · Nota
• https://github.com/SAP/cloud-security-services-integration-library · Nota
• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 · Aviso do Fabricante
• https://github.com/SAP/cloud-security-services-integration-library/commit/7ce9601979c30ae269a1cbaf7cf33486d10736f1 · Nota
• https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa · Nota
• https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security · Nota
• https://me.sap.com/notes/3411067 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50422 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gcgw-q47m-prvj · Aviso do Fabricante
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-59c9-pxq8-9c73 · Aviso do Fabricante
• https://mvnrepository.com/artifact/com.sap.cloud.security/java-security · Nota
• https://twitter.com/VulmonFeeds/status/1734465258503246255 · Publicação no Twitter
• https://me.sap.com/notes/3413475 · Nota
• https://twitter.com/CVEnew/status/1734394495087870081 · Publicação no Twitter