CVE-2023-49583

SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

• CWE-749

• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/Vendor Advisory
• https://me.sap.com/notes/3411067Permissions Required
• https://me.sap.com/notes/3412456
• https://me.sap.com/notes/3413475
• https://www.npmjs.com/package/@sap/xssecProduct
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/Vendor Advisory
• https://me.sap.com/notes/3411067Permissions Required
• https://me.sap.com/notes/3412456
• https://me.sap.com/notes/3413475
• https://www.npmjs.com/package/@sap/xssecProduct
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Dec 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49577The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, S…6.1
• CVE-2023-49578SAP Cloud Connector - version 2.0, allows an authenticated u…3.5
• CVE-2023-4958In Red Hat Advanced Cluster Security (RHACS), it was found t…6.1
• CVE-2023-49580SAP GUI for Windows and SAP GUI for Java - versions SAP_BASI…7.3
• CVE-2023-49581SAP GUI for Windows and SAP GUI for Java allow an unauthenti…9.4
• CVE-2023-49582Lax permissions set by the Apache Portable Runtime library o…5.5
• CVE-2023-49584SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_U…4.3
• CVE-2023-49587SAP Solution Manager - version 720, allows an authorized att…6.4
• CVE-2023-49588Rejected reason: This is unused.
• CVE-2023-49589An insufficient entropy vulnerability exists in the userReco…8.8
• CVE-2023-4959A flaw was found in Quay. Cross-site request forgery (CSRF) …6.5
• CVE-2023-49590Rejected reason: This is unused.