Description
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | cloud-security-services-integration-library | < 2.17.0, 3.0.0 – < 3.3.0 | 3.3.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/sap/cloud-security-client-go | < 0.17.0 | 0.17.0 | GHSA-m8rw-rcpq-2vp2 |
| Maven | com.sap.cloud.security:java-security | < 2.17.0 | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:java-security | >= 3.0.0, < 3.3.0 | 3.3.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:spring-security | < 2.17.0 | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security:spring-security | >= 3.0.0, < 3.3.0 | 3.3.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | < 2.17.0 | 2.17.0 | GHSA-59c9-pxq8-9c73 |
| Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | >= 3.0.0, < 3.3.0 | 3.3.0 | GHSA-59c9-pxq8-9c73 |
Advisories 2
- WID-SEC-2024-0025 SAP Patchday Januar 2024 BSI CERT-Bund (WID) · Jan 8, 2024
- WID-SEC-2023-3103 SAP Software: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2023
References
- https://me.sap.com/notes/3411067 vendor-advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://github.com/SAP/cloud-security-services-integration-library/
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-security
- https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 vendor-advisory
- https://me.sap.com/notes/3413475