Improper privilege management in SAP cloud-security-services-integration-library
Priority MEDIUM 52CWE-749Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01355 71st percentileScored 2026-11-07
Fix Fixed cloud-security-services-integration-library (SAP_SE): 2.17.0, 3.3.0com.sap.cloud.security:java-security (Maven): 2.17.0, 3.3.0+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | cloud-security-services-integration-library | before 2.17.0; 3.0.0 to before 3.3.0 | 2.17.0, 3.3.0 | Patch available | CNA |
| — | com.sap.cloud.security:java-security (Maven) | before 2.17.0 | 2.17.0 | Patch available | GHSA-59c9-pxq8-9c73 |
| — | com.sap.cloud.security:java-security (Maven) | 3.0.0 to before 3.3.0 | 3.3.0 | Patch available | GHSA-59c9-pxq8-9c73 |
| — | com.sap.cloud.security:spring-security (Maven) | before 2.17.0 | 2.17.0 | Patch available | GHSA-59c9-pxq8-9c73 |
| — | com.sap.cloud.security:spring-security (Maven) | 3.0.0 to before 3.3.0 | 3.3.0 | Patch available | GHSA-59c9-pxq8-9c73 |
| — | com.sap.cloud.security.xsuaa:spring-xsuaa (Maven) | before 2.17.0 | 2.17.0 | Patch available | GHSA-59c9-pxq8-9c73 |
| — | com.sap.cloud.security.xsuaa:spring-xsuaa (Maven) | 3.0.0 to before 3.3.0 | 3.3.0 | Patch available | GHSA-59c9-pxq8-9c73 |
- cloud-security-services-integration-library VendorSAP Affected before 2.17.0; 3.0.0 to before 3.3.0 Fixed in 2.17.0, 3.3.0 Patch available CNA
- com.sap.cloud.security:java-security (Maven) Vendor— Affected before 2.17.0 Fixed in 2.17.0 Patch available GHSA-59c9-pxq8-9c73
- com.sap.cloud.security:java-security (Maven) Vendor— Affected 3.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-59c9-pxq8-9c73
- com.sap.cloud.security:spring-security (Maven) Vendor— Affected before 2.17.0 Fixed in 2.17.0 Patch available GHSA-59c9-pxq8-9c73
- com.sap.cloud.security:spring-security (Maven) Vendor— Affected 3.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-59c9-pxq8-9c73
- com.sap.cloud.security.xsuaa:spring-xsuaa (Maven) Vendor— Affected before 2.17.0 Fixed in 2.17.0 Patch available GHSA-59c9-pxq8-9c73
- com.sap.cloud.security.xsuaa:spring-xsuaa (Maven) Vendor— Affected 3.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-59c9-pxq8-9c73
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:cloud-security-services-integration-library:*:*:*:*:*:java:*:* | before 2.17.0; 3.0.0 to before 3.3.0 | Vulnerable | SAP |
- cpe:2.3:a:sap:cloud-security-services-integration-library:*:*:*:*:*:java:*:* Versions before 2.17.0; 3.0.0 to before 3.3.0 Vulnerable ·SAP
Remediation
- Fix · CNA cloud-security-services-integration-library (SAP_SE) Fixed in 2.17.0, 3.3.0
- Fix · GHSA-59c9-pxq8-9c73 com.sap.cloud.security:java-security (Maven) Fixed in 2.17.0 Advisory →
- Fix · GHSA-59c9-pxq8-9c73 com.sap.cloud.security:java-security (Maven) Fixed in 3.3.0 Advisory →
- Fix · GHSA-59c9-pxq8-9c73 com.sap.cloud.security:spring-security (Maven) Fixed in 2.17.0 Advisory →
- Fix · GHSA-59c9-pxq8-9c73 com.sap.cloud.security:spring-security (Maven) Fixed in 3.3.0 Advisory →
- Fix · GHSA-59c9-pxq8-9c73 com.sap.cloud.security.xsuaa:spring-xsuaa (Maven) Fixed in 2.17.0 Advisory →
- Fix · GHSA-59c9-pxq8-9c73 com.sap.cloud.security.xsuaa:spring-xsuaa (Maven) Fixed in 3.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-50422
- 2026-10-03 Alias added: GHSA-59c9-pxq8-9c73
References
Advisory 5
- https://me.sap.com/notes/3411067
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73
- https://nvd.nist.gov/vuln/detail/CVE-2023-50422
Other 10
- https://github.com/SAP/cloud-security-services-integration-library/
- https://mvnrepository.com/artifact/com.sap.cloud.security/java-security
- https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security
- https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa
- https://me.sap.com/notes/3413475
- https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360
- https://github.com/SAP/cloud-security-services-integration-library/commit/7ce9601979c30ae269a1cbaf7cf33486d10736f1
- https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067
- https://en.wikipedia.org/wiki/JSON_Web_Token
- https://github.com/SAP/cloud-security-services-integration-library
Sources
- CVE-2023-50422 · CVE Program
- CVE-2023-50422 · NVD
- FIRST EPSS
- GHSA-59c9-pxq8-9c73 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences