critique
CVE-2023-50422
Improper JWT Signature Validation in SAP Security Services Library
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA.
Description
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security:java-security, com.sap.cloud.security:spring-security | 2.17.0, 3.3.0 |
Afficher les 3 entrées d'une source
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | 2.17.0, 3.3.0 |
| maven::GitHub Security Advisory Maven | com.sap.cloud.security:java-security | 2.17.0, 3.3.0 |
| maven::GitHub Security Advisory Maven | com.sap.cloud.security:spring-security | 2.17.0, 3.3.0 |
Références
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://en.wikipedia.org/wiki/JSON_Web_Token
- https://github.com/SAP/cloud-security-services-integration-library
- https://github.com/SAP/cloud-security-services-integration-library/
- https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360
- https://github.com/SAP/cloud-security-services-integration-library/commit/7ce9601979c30ae269a1cbaf7cf33486d10736f1
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73
Les 15 références
- https://me.sap.com/notes/3411067
- https://me.sap.com/notes/3413475
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-security
- https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security
- https://nvd.nist.gov/vuln/detail/CVE-2023-50422
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html