Improper Privilege Management in sap-xssec

严重 9.8CVE-2023-50423 · GHSA-6mjg-37cp-42x5 · PYSEC-2023-261 · Published 12/12/2023 · updated 17/06/2026

要点

CVE-2023-50423 是影响 sap-xssec, sap-xssec (sap) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.1%，高于 65.9% 的漏洞。
修复：升级到 4.1.0 或更高版本。

Package	Affected versions	Patched versions
sap-xssec PyPI	`< 4.1.0`	`4.1.0`
sap-xssec sap	`< 4.1.0`	`4.1.0`

Description

Impact

SAP BTP Security Services Integration Library ([Python] sap-xssec) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Patches

Upgrade to patched version >= 4.1.0 We always recommend to upgrade to the latest released version.

Workarounds

No workarounds

References

https://www.cve.org/CVERecord?id=CVE-2023-50423

NVD description

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

References

SAP/cloud-pysec security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-50423 · ADVISORY
SAP/cloud-pysec commit d90c9e0 · WEB
blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067 · WEB
SAP/cloud-pysec · PACKAGE
pypa/advisory-database · WEB
me.sap.com/notes/3411067 · WEB
pypi.org/project/sap-xssec · WEB
sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · WEB
blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067 · Vendor Advisory
SAP/cloud-pysec

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free