CVE-2023-50422

CRITICAL

SAP BTP Security Services Integration Library <2.17.0 and 3.0.0-<3.3.0 - Privilege Escalation

Title source: llm
STIX 2.1

Description

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

References (9)

Core 9
Core References
Permissions Required vendor-advisory
https://me.sap.com/notes/3411067

Scores

CVSS v3 9.1
EPSS 0.0135
EPSS Percentile 67.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-749
Status published
Products (4)
com.sap.cloud.security/java-security 0 - 2.17.0Maven
com.sap.cloud.security/spring-security 0 - 2.17.0Maven
com.sap.cloud.security.xsuaa/spring-xsuaa 0 - 2.17.0Maven
sap/cloud-security-services-integration-library < 2.17.0
Published Dec 12, 2023
Tracked Since Feb 18, 2026