Privilege Escalation

🗓️ 29 Sep 2025 12:24:08Reported by Veracode Vulnerability DatabaseType

Privilege escalation in SAP xssec lets unauthenticated attackers obtain arbitrary permissions via untrusted input.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2023-49583	12 Dec 202302:15	–	attackerkb
BDU FSTEC	The vulnerability of the application access control library in the SAP XS Advanced sap/xssec development, integration, and application extension platform in the SAP Business Technology Platform (BTP) environment arises from insecure management of privileges. This allows attackers to escalate their privileges.	21 Dec 202300:00	–	bdu_fstec
Circl	CVE-2023-49583	2 Jan 202409:06	–	circl
CVE	CVE-2023-49583	12 Dec 202301:22	–	cve
Cvelist	CVE-2023-49583 Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)	12 Dec 202301:22	–	cvelist
EUVD	EUVD-2023-3253	3 Oct 202520:07	–	euvd
Github Security Blog	Escalation of privileges in @sap/xssec	12 Dec 202303:31	–	github
NCSC	Vulnerabilities fixed in SAP	13 Dec 202300:00	–	ncsc
Tenable Nessus	Node.js Module @sap/approuter < 14.4.2 Privilege Escalation	23 Jul 202400:00	–	nessus
Tenable Nessus	Node.js Module @sap/xssec < 3.6.0 Privilege Escalation	5 Jul 202400:00	–	nessus

Vulners

Node

sap @sap/xssecRange1.0.2–3.5.0js

Source	Link
blogs	www.blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067
sap	www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
npmjs	www.npmjs.com/package/@sap/xssec
blogs	www.blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
blogs	www.blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
npmjs	www.npmjs.com/package/@sap/xssec
github	www.github.com/advisories/GHSA-p2vx-qj66-88q3
me	www.me.sap.com/notes/3411067
me	www.me.sap.com/notes/3412456
me	www.me.sap.com/notes/3413475

20 Jun 2026 07:32Current

7.1High risk

Vulners AI Score7.1

CVSS 3.19.1 - 9.8

EPSS0.01085

SSVC