Missing Authorization check in Item Management, SAP security note 2353024

SAP security note 2353024, "Missing Authorization check in Item Management". Below are the symptom, SAP recommended solution and CVSS score.

Description

Symptom

Item Management in Account Management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

The affected functions have now been enforced to properly check access restrictions. Please implement the correction instructions.

CVSS

Score 5.4 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N