Missing Authorization check in SAP ERP Materials Management, SAP security note 2378999

SAP security note 2378999, "Missing Authorization check in SAP ERP Materials Management". Below are the symptom and SAP recommended solution.

Description

Symptom

The SAP ERP Materials Management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

The affected functions have now been enforced to properly check access restrictions. Please implement the correction instructions.

CVSS

Score 6.3/10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L