Missing Authorization check in EHS Task Definition attachments, SAP security note 2873099

SAP security note 2873099, "Missing Authorization check in EHS Task Definition attachments", released on 10.11.2020. Below are the symptom and SAP recommended solution.

Description

Symptom

The following applications do not perform the necessary authorization checks for an authenticated user, resulting in escalation of privileges for attachments related to a task definition:

• Manage Task Definition (F2528)
• Manage Change Request Task (F3415)
• Manage Maintenance Notification Task (F3415)

Impacts of missing authorization checks include:

• Abusing functionality restricted to particular user groups
• Reading, modifying, or deleting restricted data

Solution

The affected functions have been updated to properly enforce access restrictions.

Alternatively, you can implement the correction instructions available here.

Reason and prerequisites

The validity of the correction is maintained in the correction instructions.

CVSS

Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L