SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
Summary
SAP has disclosed a critical vulnerability in its Cloud SDK for Python that allows attackers to steal OAuth2 client credentials. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, requiring an attacker to control a tenant subdomain to exploit it.
IFF Assessment
This vulnerability allows for the theft of sensitive OAuth2 client credentials, which can be used by attackers to gain unauthorized access to SAP applications and data.
Severity
The article explicitly mentions a CVSS 10.0 score, indicating a critical severity level due to the ability to remotely steal sensitive credentials (OAuth2 client credentials) without requiring any privileges.
Defender Context
This critical vulnerability highlights the importance of promptly patching software and reviewing configurations, especially in cloud environments. Defenders should be aware of the potential for credential theft in SAP BTP environments utilizing the Cloud SDK for Python and ensure that all relevant SAP security advisories are monitored and acted upon.