Vulnerability Details CVE-2023-50424
SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 69.5%
CVSS Severity
CVSS v3 Score 9.1
References
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://github.com/SAP/cloud-security-client-go
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73
- https://me.sap.com/notes/3411067
- https://pkg.go.dev/github.com/sap/cloud-security-client-go@v0.17.0
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://github.com/SAP/cloud-security-client-go
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73
- https://me.sap.com/notes/3411067
- https://pkg.go.dev/github.com/sap/cloud-security-client-go@v0.17.0
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Products affected by CVE-2023-50424
-
cpe:2.3:a:sap:cloud-security-client-go:0.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.1.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.1.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.1.2
-
cpe:2.3:a:sap:cloud-security-client-go:0.10.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.10.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.11.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.12.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.13.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.14.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.14.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.15.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.16.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.2.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.3.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.2
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.3
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.4
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.5
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.6
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.7
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.8
-
cpe:2.3:a:sap:cloud-security-client-go:0.4.9
-
cpe:2.3:a:sap:cloud-security-client-go:0.5.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.5.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.5.2
-
cpe:2.3:a:sap:cloud-security-client-go:0.5.3
-
cpe:2.3:a:sap:cloud-security-client-go:0.5.4
-
cpe:2.3:a:sap:cloud-security-client-go:0.6.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.6.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.7.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.8.0
-
cpe:2.3:a:sap:cloud-security-client-go:0.8.1
-
cpe:2.3:a:sap:cloud-security-client-go:0.9.0