PT-2023-7892 · Sap · Sap Btp Security Services Integration Library

Rosenblueh · Published 2023-12-11 · Updated 2024-09-28 · CVE-2023-50424

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP BTP Security Services Integration Library versions < 0.17.0

Description The issue allows an unauthenticated attacker to obtain arbitrary permissions within the application under certain conditions. This is due to insecure privilege management in the SAP BTP Security Services Integration Library. On successful exploitation, the attacker can escalate privileges.

Recommendations Upgrade to a patched version >= 0.17.0 As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation until a patch is applied.

Fix

IDOR

Improper Privilege Management

Weakness Enumeration

CWE-639

CWE-749

CWE-269

Related Identifiers

BDU:2023-08963

CVE-2023-50424

GHSA-59C9-PXQ8-9C73

GHSA-92CG-GHQ6-9587

GHSA-M8RW-RCPQ-2VP2

GO-2023-2400

Affected Products

Sap Btp Security Services Integration Library

References · 27

• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08963 · Security Note
• https://me.sap.com/notes/3411067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50422 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59c9-pxq8-9c73 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2400 · Vendor Advisory
• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8rw-rcpq-2vp2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50424 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-92cg-ghq6-9587 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50424 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-50424 · Security Note
• https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360 · Note
• https://github.com/SAP/cloud-security-services-integration-library · Note