Description (CNA)
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SAP_SE / SAP Cloud | affected sap-cloud-sdk < 0.45.2 |
CWE
CWE-918
References
- https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2
- https://url.sap/sapsecuritypatchday
ADP enrichment
No English description supplied.
No references supplied.