Improper JWT Signature Validation in SAP Security Services Library

KRITISCH 9.8CVE-2023-50422 · CVE-2023-50424 · GHSA-59c9-pxq8-9c73 · Published 12/12/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-50422 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in github.com/sap/cloud-security-client-go, com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security:java-security.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.4%, höher als bei 71.6% aller Schwachstellen.
Abhilfe: auf 0.17.0, 3.3.0, 2.17.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/sap/cloud-security-client-go Go	`< 0.17.0`	`0.17.0`
com.sap.cloud.security.xsuaa:spring-xsuaa Maven	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`
com.sap.cloud.security:java-security Maven	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`
com.sap.cloud.security:spring-security Maven	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`
cloud-security-services-integration-library sap	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`

Description

Impact

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Patches

Upgrade to patched version >= 2.17.0 or >= 3.3.0 We always recommend to upgrade to the latest released version.

Workarounds

No workarounds

References

https://www.cve.org/CVERecord?id=CVE-2023-50422

NVD description

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free