Description
UPDATE 10th November 2020: This note has been re-released with updated ‘Correction instruction’ information. We added the prerequisite note 2697309 in the correction instruction 683173 for S4CORE 103.
The Manage Task Definition (F2528), Manage Change Request Task (F3415) and Manage Maintenance Notification Task (F3415) applications do not perform the necessary authorization checks for an authenticated user, resulting in escalation of privileges for attachments related to a task definition.
Some well-known impacts of missing authorization checks are:
- abusing functionality, restricted to a particular user group
- reading, modifying or deleting restricted data
Available fix and Supported packages
- SAPSCORE | 119 | 119
- S4CORE | 103 | 103
- S4CORE | 104 | 104
- | SAPK-S4CLOUD_2005 |
- SAPSCORE 119 | SAPK-11907INSAPSCORE |
- S4CORE 103 | SAPK-10304INS4CORE |
- S4CORE 104 | SAPK-10402INS4CORE |
Affected component
- EHS-SUS-FND
Sustainability Foundation
CVSS
Score: 5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2873099
