CVE-2023-50423

SAPBTPSecurity Services Integration Library ([Python]sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
sapCNA
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
VendorProductVersion
sapsap-xssec
𝑥
< 4.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
https://github.com/SAP/cloud-pysec/
https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5
https://me.sap.com/notes/3411067
https://pypi.org/project/sap-xssec/
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
https://github.com/SAP/cloud-pysec/
https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5
https://me.sap.com/notes/3411067
https://pypi.org/project/sap-xssec/
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html