CVE-2018-2436 Missing Authorization check in Function Module WRCK_STORE_LOESCH_KONSISTENZ, SAP security note 2652578

SAP security note 2652578, "CVE-2018-2436 Missing Authorization Check in Function Module WRCK_STORE_LOESCH_KONSISTENZ". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Executing transaction WRCK results in a system dump. The Function Module WRCK_STORE_LOESCH_KONSISTENZ does not perform necessary authorization checks for authenticated users, allowing potential escalation of privileges.

• Abuse of functionality restricted to specific user groups
• Unauthorized reading, modification, or deletion of restricted data

Solution

Implement the source code correction provided in the security note to introduce the necessary authorization checks. Ensure that users executing the transaction have the required authorization object ‘M_MATE_STA’ with activity code "06".

CVSS

Score 6.4 Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

References

• CVE-2018-2436
• Related SAP Note 1988903

Affected components

• EA-RETAIL (600 to 618)
• S4CORE (100 to 102)