Missing authorization checks for enhanced contract data, SAP security note 1766044

SAP security note 1766044, "Missing authorization checks for enhanced contract data". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of the enhanced contract data to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached program correction or import the corresponding Support Package.

Reason and prerequisites

The enhanced contract data does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

Affected components

• SAP_APPL 603 to 617