sap cloud_sdk 信息暴露

CVE编号

CVE-2021-41251

利用情况

暂无

补丁情况

N/A

披露时间

2021-11-06

漏洞描述

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions. By default, destination caching is disabled. The security for caching has been increased. The changes are released in version 1.52.0. Users unable to upgrade are advised to disable destination caching (it is disabled by default).

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/SAP/cloud-sdk-js/pull/1769
https://github.com/SAP/cloud-sdk-js/pull/1770
https://github.com/SAP/cloud-sdk-js/security/advisories/GHSA-gp2f-254m-rh32

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	sap	cloud_sdk	*		Up to (excluding) 1.52.0

CVSS3评分 5.9

• 攻击路径 网络
• 攻击复杂度 高
• 权限要求 无
• 影响范围 未更改
• 用户交互 无
• 可用性 无
• 保密性 高
• 完整性 无

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-ID 漏洞类型 CWE-200 信息暴露