Missing Authorization check in SAP Vehicle Management System (VMS), SAP security note 2501605

SAP security note 2501605, "Missing Authorization check in SAP Vehicle Management System (VMS)", is a note released on 09.07.2019. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP VMS (IS-A-VMS) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of missing authorization checks are:

• Abuse of functionality restricted to a particular user group
• Reading, modifying, or deleting restricted data

Solution

Implement the correction instructions provided in this note.

Reason and prerequisites

SAP VMS does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.

CVSS

Score 5.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected components

• SAPSCORE 110
• S4CORE 100, 101, 102
• ECC-DIMP 600, 602, 603, 604, 605, 606, 616, 617, 618