Description
In SAP S/4 HANA’s Fiori UI for General Ledger Accounting, an attacker with a non-administrative user account can identify and remove certain attachments belonging to another user without authorization. Removing the attachment does not depend on any action to be taken by the owning user. The attacker cannot view or alter the contents of the attachment, they can only remove it making it unavailable to its owner.
Available fix and Supported packages
- S4CORE | 103 | 103
- S4CORE | 104 | 104
- | SAPK-S4CLOUD_2008 |
- S4CORE 103 | SAPK-10305INS4CORE |
- S4CORE 104 | SAPK-10403INS4CORE |
Affected component
- FI-FIO-GL
Fiori UI for General Ledger Accounting
CVSS
Score: 4.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2885671
