CVE-2023-49583 Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)
An unauthenticated attacker can escalate privileges to obtain arbitrary permissions in applications using the vulnerable SAP BTP security library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49583?
CVE-2023-49583 is a critical vulnerability in SAP_SE @sap/xssec, published on 12 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Weakness: CWE-749
Which versions are affected by CVE-2023-49583?
2 open source packages ship an affected version, including @sap/xssec. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sap/xssec npm | All versions | 3.6.0 |
@sap/xssec npm | All versions | 3.6.0 |
Products include Sap \@Sap\/Xssec.
How do I fix CVE-2023-49583?
Upgrade @sap/xssec to 3.6.0 or later.
Is CVE-2023-49583 being exploited?
There is no known exploitation of CVE-2023-49583 in the wild and no public exploit code.
Sources
Also known as GHSA-p2vx-qj66-88q3.