Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)

CVE-2023-49583

Summary

The SAP BTP Security Services Integration Library, specifically versions prior to 3.6.0 of the @sap/xssec package, is vulnerable to privilege escalation. This vulnerability permits an unauthenticated attacker to gain arbitrary permissions within the application under certain conditions. Exploitation could potentially lead to unauthorized access to sensitive functionalities, allowing the attacker to perform actions as if they were a legitimate user.

References