{"id":"CVE-2023-50423","aliases":["GHSA-6mjg-37cp-42x5","PYSEC-2023-261"],"title":"Improper Privilege Management in sap-xssec","summary":"Improper Privilege Management in sap-xssec","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","vendor":"sap-xssec","product":"sap-xssec","ecosystem":"pip","affected":["sap-xssec < 4.1.0"],"patched":["sap-xssec 4.1.0"],"published":"2023-12-13","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6mjg-37cp-42x5","references":[{"url":"https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50423"},{"url":"https://github.com/SAP/cloud-pysec/commit/d90c9e0733fa9af68bd8ea0b1cf023cf482163ef"},{"url":"https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067"},{"url":"https://github.com/SAP/cloud-pysec"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/sap-xssec/PYSEC-2023-261.yaml"},{"url":"https://me.sap.com/notes/3411067"},{"url":"https://pypi.org/project/sap-xssec"},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}],"tags":["osv","pip"],"epss":0.01109,"epssPercentile":0.63943,"ingestedAt":"2026-07-08T18:25:46.492Z","slug":"CVE-2023-50423","body":"## Overview\n\n### Impact\n\nSAP BTP Security Services Integration Library ([Python] sap-xssec) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.\n\n### Patches\nUpgrade to patched version >= 4.1.0\nWe always recommend to upgrade to the latest released version.\n\n### Workarounds\nNo workarounds\n\n### References\nhttps://www.cve.org/CVERecord?id=CVE-2023-50423\n\n\n## Affected packages\n\n- `sap-xssec < 4.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `sap-xssec 4.1.0`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}