Lucene search

PRIOn knowledge basePRION:CVE-2023-49583

HistoryDec 12, 2023 - 2:15 a.m.

Privilege escalation

2023-12-1202:15:00

PRIOn knowledge base

www.prio-n.com

sap

btp

security services

integration library

privilege escalation

vulnerability

node.js

xssec

exploitation

unauthenticated attacker

arbitrary permissions

application

7.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

47.5%

JSON

SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

CPENameOperatorVersion
\\@sap\\/xsseclt3.6.0

CPE	Name	Operator	Version
	\\@sap\\/xssec	lt	3.6.0

References

blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/

me.sap.com/notes/3411067

me.sap.com/notes/3412456

me.sap.com/notes/3413475

www.npmjs.com/package/@sap/xssec

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html