Description
CRM-BF-PC does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
It is possible to insert a new card to a sales orders even though the authority object CRM_ORD_PC is not granted.
Available fix and Supported packages
- BBPCRM | 700 | 700
- BBPCRM | 701 | 701
- BBPCRM | 702 | 702
- BBPCRM | 712 | 712
- BBPCRM | 713 | 713
- BBPCRM | 714 | 714
- BBPCRM 701 | SAPKU70115 |
- BBPCRM 712 | SAPKU71210 |
- BBPCRM 702 | SAPKU70217 |
- BBPCRM 713 | SAPKU71312 |
- BBPCRM 714 | SAPK-71403INBBPCRM |
- BBPCRM 700 | SAPKU70019 |
Affected component
- CRM-BF-PC
Payment Cards
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2307916
