CVE-2023-50423Critical· 9.1▾ MidnightImproper Privilege Management in sap-xssec
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.1%
SAP BTP Security Services Integration Library ([Python] sap-xssec) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Upgrade to patched version >= 4.1.0 We always recommend to upgrade to the latest released version.
No workarounds
https://www.cve.org/CVERecord?id=CVE-2023-50423
sap-xssec < 4.1.0Upgrade to a patched release:
sap-xssec 4.1.0