SAP security note 2344639, “Missing Authorization Check in Commodity Risk Management.” Below are the symptom and the SAP recommended solution.
Description
Symptom
The Information System of Commodity Risk Management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This can lead to:
- Abuse of functionality restricted to a particular user group
- Unauthorized reading, modification, or deletion of restricted data
Solution
Implement the attached correction or the corresponding support package.
Reason and prerequisites
A user with access to the Information System of Commodity Risk Management may potentially retrieve information about exposures without appropriate authorization checks.
CVSS
Score 4.3/10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Full note on SAP: SAP Support Launchpad note 2344639
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
