Improper JWT Signature Validation in SAP Security Services Library

CRITICO 9.8CVE-2023-50422 · CVE-2023-50424 · GHSA-59c9-pxq8-9c73 · Published 12/12/2023 · updated 17/06/2026

In breve

CVE-2023-50422 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda github.com/sap/cloud-security-client-go, com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security:java-security.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.4%, superiore al 71.7% delle vulnerabilità.
Correzione: aggiornare a 0.17.0, 3.3.0, 2.17.0 o successiva.

Package	Affected versions	Patched versions
github.com/sap/cloud-security-client-go Go	`< 0.17.0`	`0.17.0`
com.sap.cloud.security.xsuaa:spring-xsuaa Maven	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`
com.sap.cloud.security:java-security Maven	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`
com.sap.cloud.security:spring-security Maven	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`
cloud-security-services-integration-library sap	`≥ 3.0.0, < 3.3.0< 2.17.0`	`3.3.02.17.0`

Description

Impact

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Patches

Upgrade to patched version >= 2.17.0 or >= 3.3.0 We always recommend to upgrade to the latest released version.

Workarounds

No workarounds

References

https://www.cve.org/CVERecord?id=CVE-2023-50422

NVD description

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free