CVE-2023-49583: 
JavaScript vulnerability analysis and mitigation

SAP BTP Security Services Integration Library (@sap/xssec) versions prior to 3.6.0 contain a critical privilege escalation vulnerability (CVE-2023-49583). The vulnerability allows an unauthenticated attacker to obtain arbitrary permissions within the application under certain conditions (NVD, SAP Blog).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) by NVD and 9.1 (Critical) by SAP SE. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high impact to confidentiality, integrity, and availability (NVD).

Upon successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application, potentially leading to complete compromise of the affected system's security. The vulnerability affects applications developed through SAP Business Application Studio, SAP Web IDE Full-Stack, and SAP Web IDE for SAP HANA (Cybersecurity News).

Users are strongly advised to upgrade to SAP BTP Security Services Integration Library version 3.6.0 or later to address this vulnerability. SAP has released security patches as part of their December 2023 Security Patch Day (Security Online).