~ / search / GHSA-59c9-pxq8-9c73

GHSA-59c9-pxq8-9c73

Improper JWT Signature Validation in SAP Security Services Library

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-50422

Packages

EcosystemPackageAffectedFixed in
Maven com.sap.cloud.security:java-security < 2.17.0 2.17.0
Maven com.sap.cloud.security:java-security >= 3.0.0, < 3.3.0 3.3.0
Maven com.sap.cloud.security:spring-security < 2.17.0 2.17.0
Maven com.sap.cloud.security:spring-security >= 3.0.0, < 3.3.0 3.3.0
Maven com.sap.cloud.security.xsuaa:spring-xsuaa < 2.17.0 2.17.0
Maven com.sap.cloud.security.xsuaa:spring-xsuaa >= 3.0.0, < 3.3.0 3.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. ### Patches Upgrade to patched version >= 2.17.0 or >= 3.3.0 We always recommend to upgrade to the latest released version. ### Workarounds No workarounds ### References https://www.cve.org/CVERecord?id=CVE-2023-50422

References

External links from the advisory. They lead to third-party sites.