PT-2023-7890 · Sap · Sap Btp Security Services Integration Library

Rosenblueh · Published 2023-12-11 · Updated 2024-09-28 · CVE-2023-50422

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP BTP Security Services Integration Library versions below 2.17.0 SAP BTP Security Services Integration Library versions from 3.0.0 to before 3.3.0

Description The issue is related to insecure privilege management in the SAP BTP Security Services Integration Library, allowing an unauthenticated attacker to obtain arbitrary permissions within the application under certain conditions. On successful exploitation, this can lead to an escalation of privileges.

Recommendations For versions below 2.17.0, upgrade to version 2.17.0 or later. For versions from 3.0.0 to before 3.3.0, upgrade to version 3.3.0 or later. It is recommended to upgrade to the latest released version to ensure all security patches are applied.

Fix

IDOR

Improper Privilege Management

Weakness Enumeration

CWE-639

CWE-749

CWE-269

Related Identifiers

BDU:2023-08961

CVE-2023-50422

GHSA-59C9-PXQ8-9C73

GHSA-GCGW-Q47M-PRVJ

Affected Products

Sap Btp Security Services Integration Library

References · 21

• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 · Vendor Advisory
• https://me.sap.com/notes/3411067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50422 · Security Note
• https://osv.dev/vulnerability/GHSA-gcgw-q47m-prvj · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59c9-pxq8-9c73 · Vendor Advisory
• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-50422 · Security Note
• https://bdu.fstec.ru/vul/2023-08961 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50422 · Vendor Advisory
• https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360 · Note
• https://github.com/SAP/cloud-security-services-integration-library · Note
• https://github.com/SAP/cloud-security-services-integration-library/commit/7ce9601979c30ae269a1cbaf7cf33486d10736f1 · Note
• https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa · Note
• https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security · Note