CVE-2023-50423 Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)

2023-12-1201:52:44

CWE-269

sap

www.cve.org

cve-2023-50423

escalation of privileges

sap btp

security services integration library

python

cloud-pysec

sap-xssec

unauthenticated attacker

arbitrary permissions

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.5%

JSON

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "sap-xssec",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.1.0"
      }
    ]
  }
]