CVE-2023-50422

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

• CWE-749

• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/Vendor Advisory
• https://github.com/SAP/cloud-security-services-integration-library/Product
• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73Vendor Advisory
• https://me.sap.com/notes/3411067Permissions Required
• https://me.sap.com/notes/3413475
• https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaaProduct
• https://mvnrepository.com/artifact/com.sap.cloud.security/java-securityProduct
• https://mvnrepository.com/artifact/com.sap.cloud.security/spring-securityProduct
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/Vendor Advisory
• https://github.com/SAP/cloud-security-services-integration-library/Product
• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73Vendor Advisory
• https://me.sap.com/notes/3411067Permissions Required
• https://me.sap.com/notes/3413475
• https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaaProduct
• https://mvnrepository.com/artifact/com.sap.cloud.security/java-securityProduct
• https://mvnrepository.com/artifact/com.sap.cloud.security/spring-securityProduct
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Dec 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50383Three os command injection vulnerabilities exist in the boa …7.2
• CVE-2023-50386Improper Control of Dynamically-Managed Code Resources, Unre…8.8
• CVE-2023-50387Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 403…7.5
• CVE-2023-50395 SQL Injection Remote Code Execution Vulnerability was found…8
• CVE-2023-5041The Track The Click WordPress plugin before 0.3.12 does not …8.8
• CVE-2023-5042Sensitive information disclosure due to insecure folder perm…7.5
• CVE-2023-50423SAP BTP Security Services Integration Library ([Python] sap-…9.8
• CVE-2023-50424SAP BTP Security Services Integration Library ([Golang] gith…9.8
• CVE-2023-50428In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.k…5.3
• CVE-2023-50429IzyBat Orange casiers before 20230803_1 allows getEnsemble.p…9.1
• CVE-2023-5043Ingress nginx annotation injection causes arbitrary command …8.8
• CVE-2023-50430The Goodix Fingerprint Device, as shipped in Dell Inspiron 1…6.4