Description (CNA)
The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SAP_SE / SAP/cloud-security-services-integration-library | affected >=3.6.6; affected <4.1.1 |
CWE
CWE-1188
References
- https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-857v-p42q-f3qf
- https://url.sap/sapsecuritypatchday
ADP enrichment
No English description supplied.
No references supplied.