title: Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)
description: SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
product: cloud-security-services-integration-library
vendor: SAP_SE
versions:
status: affected, version: < 2.17.0
lessThan: 3.3.0, status: affected, version: 3.0.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL