Missing Authorization check in Commodity Risk Management, SAP security note 2344639

SAP security note 2344639, “Missing Authorization Check in Commodity Risk Management.” Below are the symptom and the SAP recommended solution.

Description

Symptom

The Information System of Commodity Risk Management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This can lead to:

• Abuse of functionality restricted to a particular user group
• Unauthorized reading, modification, or deletion of restricted data

Solution

Implement the attached correction or the corresponding support package.

Reason and prerequisites

A user with access to the Information System of Commodity Risk Management may potentially retrieve information about exposures without appropriate authorization checks.

CVSS

Score 4.3/10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N