PT-2023-7892 · Sap · Sap Btp Security Services Integration Library

Rosenblueh · Publicado 2023-12-11 · Atualizado 2024-09-28 · CVE-2023-50424

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP BTP Security Services Integration Library versions < 0.17.0

Description The issue allows an unauthenticated attacker to obtain arbitrary permissions within the application under certain conditions. This is due to insecure privilege management in the SAP BTP Security Services Integration Library. On successful exploitation, the attacker can escalate privileges.

Recommendations Upgrade to a patched version >= 0.17.0 As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation until a patch is applied.

Correção

IDOR

Improper Privilege Management

Enumeração de Fraquezas

CWE-639

CWE-749

CWE-269

Identificadores relacionados

BDU:2023-08963

CVE-2023-50424

GHSA-59C9-PXQ8-9C73

GHSA-92CG-GHQ6-9587

GHSA-M8RW-RCPQ-2VP2

GO-2023-2400

Produtos afetados

Sap Btp Security Services Integration Library

Referências · 27

• https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360 · Nota
• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 · Aviso do Fabricante
• https://github.com/SAP/cloud-security-services-integration-library · Nota
• https://github.com/SAP/cloud-security-services-integration-library/commit/7ce9601979c30ae269a1cbaf7cf33486d10736f1 · Nota
• https://github.com/SAP/cloud-security-client-go · Nota
• https://github.com/SAP/cloud-security-client-go/security/advisories/GHSA-m8rw-rcpq-2vp2 · Nota
• https://github.com/SAP/cloud-security-client-go/commit/2e3bd63e152e09f267316a1071034eb5d4b7f498 · Nota
• https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa · Nota
• https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security · Nota
• https://bdu.fstec.ru/vul/2023-08963 · Nota de Segurança
• https://me.sap.com/notes/3411067 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50422 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1734462475188199661 · Publicação no Twitter
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-59c9-pxq8-9c73 · Aviso do Fabricante