Description
UPDATE 26th November 2019: This note has been re-released with updated “Symptom” information.
SAP ERP HCM Spain does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.
This solution is only relevant for HCM Spain location.
Available fix and Supported packages
- SAP_HRCES | 600 | 600
- SAP_HRCES | 604 | 604
- SAP_HRCES | 608 | 608
- SAP_HRCES 604 | SAPK-604E1INSAPHRCES |
- SAP_HRCES 600 | SAPK-600H5INSAPHRCES |
- SAP_HRCES 608 | SAPK-60869INSAPHRCES |
Affected component
- PY-ES
Spain
CVSS
Score: 5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2798133
