Description
SAP Funding Management does not execute the required authorization checks for an authenticated user, which may result in an escalation of privileges.
The known effects of the missing authorization check include:
- Fraudulent or incorrect use of functions the use of which should be restricted to certain user groups
- Ability to read, modify or delete data, to which access should be restricted.
Available fix and Supported packages
- FUNDMGMT | 300 | 300
- FUNDMGMT 300 | SAPK-30009INFUNDMGMT |
Affected component
- FS-TXS
Funding Management
CVSS
Score: 8.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2776558
