What is GHSA-gp2f-254m-rh32?

GHSA-gp2f-254m-rh32 is a security advisory published by GitHub Security Advisories with Medium severity. Unauthorized access to data in @sap-cloud-sdk/core

Which CVE IDs does GHSA-gp2f-254m-rh32 cover?

GHSA-gp2f-254m-rh32 covers the following CVE IDs: CVE-2021-41251. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gp2f-254m-rh32?

GHSA-gp2f-254m-rh32 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-gp2f-254m-rh32?

GHSA-gp2f-254m-rh32 affects 1 product, including: npm/@sap-cloud-sdk/core:\u003c 1.52.0.

GHSA-gp2f-254m-rh32MediumCVSS 5.9

Unauthorized access to data in @sap-cloud-sdk/core

Vendor

GitHub Security Advisories

Published

November 10, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-41251 →

📋 Description

Impact

This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions. By default, destination caching is disabled. If it is enabled the maximum lifetime is 5 minutes which limits the attack vector.

Patches

The problem was fixed by #1769 and #1770. The security for caching has been increased. The changes are released in version 1.52.0.

Workarounds

Disable destination caching (it is disabled by default).

References

destination cache API docs

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/SAP/cloud-sdk-js

🎯 Affected products1

npm/@sap-cloud-sdk/core:< 1.52.0