Missing authorization check in time zones, SAP security note 1563860

SAP security note 1563860, "Missing authorization check in time zones". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can utilize functions of time zones to which access should be restricted. This lack of proper authorization checks may lead to an escalation of privileges, potentially resulting in unintended system behavior.

Solution

Implement the corrections as outlined in the correction instructions provided by SAP.

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:S/C:N/I:P/A:N

Affected components

• SAP_BASIS versions 620 to 730 (including 700, 702, 710, etc.)