Potential information disclosure in investigation, SAP security note 1816886

SAP security note 1816886, “Potential information disclosure in investigation”, is a program error note. Below are the symptom and SAP recommended solution.

Description

Symptom

This SAP Security Note addresses a potential information disclosure issue within the Incident Management component. Specifically, incident tasks could reveal confidential information about investigations to users who do not have the appropriate access levels assigned.

Incident tasks can inadvertently expose confidential investigation details to unauthorized users lacking the necessary access permissions.

Solution

You can resolve the issue by applying the relevant Support Packages or by following the correction instructions provided in this SAP Note.

Reason and prerequisites

This issue stems from a programming error that fails to properly restrict access to sensitive investigation information.