CVE-2023-50424

CRITICAL 9.8CVE-2023-50424 · Published 12/12/2023 · updated 17/06/2026

In short

CVE-2023-50424 is a CRITICAL (CVSS 9.8) vulnerability affecting cloud-security-client-go (sap).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.4% of all vulnerabilities.
Fix: update to 0.17.0 or later.

Package	Affected versions	Patched versions
cloud-security-client-go sap	`< 0.17.0`	`0.17.0`

Description

SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

References

blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067 · Vendor Advisory
SAP/cloud-security-client-go · Product
SAP/cloud-security-services-integration-library security advisory · Not Applicable
me.sap.com/notes/3411067 · Permissions Required
pkg.go.dev/github.com/sap/[email protected] · Product
sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free