Missing Authorization Checks in the Monitor Data and My Data Collections Apps, SAP security note 2990992

SAP security note 2990992, "Missing Authorization Checks in the Monitor Data and My Data Collections Apps", is a note released on 09.02.2021. Below are the symptom and SAP recommended solution.

Description

Symptom

The Monitor Data (F2436) and My Data Collections (F3991) apps do not perform the necessary authorization checks for an authenticated user, resulting in an escalation of privileges.

Impacts of missing authorization checks:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

The affected functions have now been enforced to properly check access restrictions.

CVSS

Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• 3018107 – My Data Collections authorization check is too restrictive