@sap-cloud-sdk/core (>=1.48.2-20210910061518.0, <=1.49.1-20210922143656.0), @sap/approuter (>=8.0.0, <=14.4.1) +6 more potentially affected by CVE-2023-49583 via @sap/xssec (>=3.0.3, <=3.5.0)

@sap/xssec NPM version =3.0.3, =1.48.2-20210910061518.0, =8.0.0, =3.2.0, =1.9.38, =6.0.2, =7.4.2, =0.1.92, =0.2.1, =0.4.1 Source cves: CVE-2023-49583 Source advisory: OSV:GHSA-P2VX-QJ66-88Q3...

CVE-2023-49583

SAP BTP Security Services Integration Library Node.js @sap/xssec - versions 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

CVE-2023-49583 Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)

SAP BTP Security Services Integration Library Node.js @sap/xssec - versions 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

CVE-2023-49583

The CVE-2023-49583 issue applies to SAP BTP Security Services Integration Library in the Node.js module @sap/xssec (and related SAP modules) when using versions prior to 3.6.0. The root cause is a privilege-escalation flaw that can allow an unauthenticated attacker to obtain arbitrary permissions...