CVE-2023-50422 Privilege escalation in cloud-security-services-integration-library
An unauthenticated attacker can escalate privileges to obtain arbitrary permissions within applications using the SAP BTP Security Services Integration Library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50422?
CVE-2023-50422 is a critical vulnerability in SAP_SE cloud-security-services-integration-library, published on 12 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Weakness: CWE-749
Which versions are affected by CVE-2023-50422?
It affects 1 product.
Products include Sap Cloud-Security-Services-Integration-Library.
How do I fix CVE-2023-50422?
Upgrade to a fixed version.
Is CVE-2023-50422 being exploited?
There is no known exploitation of CVE-2023-50422 in the wild and no public exploit code.