Skip to content
Fencer Intel
critical 9.1

CVE-2023-50422 json

Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)

published 2y ago modified 4mo ago also CVE-2023-50424 , GHSA-59c9-pxq8-9c73 , GHSA-92cg-ghq6-9587 , GHSA-m8rw-rcpq-2vp2 , GO-2023-2400 , EUVD-2023-3112

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Patch / fix

  • go github.com/sap/cloud-security-client-go 0.17.0
  • maven com.sap.cloud.security:java-security 2.17.0, 3.3.0
  • maven com.sap.cloud.security:spring-security 2.17.0, 3.3.0
  • maven com.sap.cloud.security.xsuaa:spring-xsuaa 2.17.0, 3.3.0
  • SAP_SE cloud-security-services-integration-library 3.3.0

Is CVE-2023-50422 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2y ago

Exploit prediction

1.36% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-15).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/sap/cloud-security-client-go
<0.17.0
0.17.0
maven com.sap.cloud.security:java-security
<2.17.0
>=3.0.0, <3.3.0
2.17.0
3.3.0
maven com.sap.cloud.security:spring-security
<2.17.0
>=3.0.0, <3.3.0
2.17.0
3.3.0
maven com.sap.cloud.security.xsuaa:spring-xsuaa
<2.17.0
>=3.0.0, <3.3.0
2.17.0
3.3.0

Affected products

  • SAP_SE cloud-security-services-integration-library

Classification

Weakness
  • CWE-749 Exposed Dangerous Method or Function
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.