Missing Authorization check in Travel Management, SAP security note 2847817

SAP security note 2847817, “Missing Authorization check in Travel Management”. Below are the symptom and SAP recommended solution.

Description

Symptom

Travel Management Fiori Applications (MTR V2 and MTE V2) do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

The affected functions have now been enforced to properly check access restrictions. Please implement the correction instructions.

Reason and prerequisites

Program error.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N