CVE-2023-50423 Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)

2023-12-1201:52:44

CWE-749

sap

www.cve.org

cve-2023-50423

escalation of privileges

sap btp

security services integration library

python

cloud-pysec

sap-xssec

unauthenticated attacker

arbitrary permissions

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

47.4%

JSON

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "sap-xssec",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.1.0"
      }
    ]
  }
]