SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under
    certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker
    can obtain arbitrary permissions within the application. (CVE-2023-49583)

The nodejs module @sap/approuter detected on the host is prior to version 14.4.2. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain arbitrary permissions within the applicaiton.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The nodejs module @sap/xssec detected on the host is prior to version 3.6.0. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain arbitrary permissions within the applicaiton.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
421520	SCA: security update for @sap/xssec (GHSA-p2vx-qj66-88q3)	Tenable Cloud Security	SCA Checks	critical
421520	SCA: security update for @sap/xssec (GHSA-p2vx-qj66-88q3)	Tenable Self-Hosted Container Security	SCA Checks	critical
203018	Node.js Module @sap/approuter < 14.4.2 Privilege Escalation	Nessus	Misc.	critical
201921	Node.js Module @sap/xssec < 3.6.0 Privilege Escalation	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-49583

critical

Tenable Plugins

critical

critical

critical

critical