CVE-2023-50423

Advisory

Sap-xssec 4.1.0 includes a fix for CVE-2023-50423: Versions <4.1.0 allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. See CVE-2023-50423.


MISC:https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/: https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
MISC:https://github.com/SAP/cloud-pysec/: https://github.com/SAP/cloud-pysec/
MISC:https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5: https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5
MISC:https://me.sap.com/notes/3411067: https://me.sap.com/notes/3411067
MISC:https://pypi.org/project/sap-xssec/: https://pypi.org/project/sap-xssec/
MISC:https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html: https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Resources

• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
• https://github.com/SAP/cloud-pysec/
• https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5
• https://me.sap.com/notes/3411067
• https://pypi.org/project/sap-xssec/
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50423