kritik
CVE-2023-50422
Improper JWT Signature Validation in SAP Security Services Library
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA.
Açıklama
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security:java-security, com.sap.cloud.security:spring-security | 2.17.0, 3.3.0 |
1 kaynaktaki 3 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.sap.cloud.security.xsuaa:spring-xsuaa | 2.17.0, 3.3.0 |
| maven::GitHub Security Advisory Maven | com.sap.cloud.security:java-security | 2.17.0, 3.3.0 |
| maven::GitHub Security Advisory Maven | com.sap.cloud.security:spring-security | 2.17.0, 3.3.0 |
Referanslar
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://en.wikipedia.org/wiki/JSON_Web_Token
- https://github.com/SAP/cloud-security-services-integration-library
- https://github.com/SAP/cloud-security-services-integration-library/
- https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360
- https://github.com/SAP/cloud-security-services-integration-library/commit/7ce9601979c30ae269a1cbaf7cf33486d10736f1
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73
15 referansın hepsi
- https://me.sap.com/notes/3411067
- https://me.sap.com/notes/3413475
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-security
- https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security
- https://nvd.nist.gov/vuln/detail/CVE-2023-50422
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html