A non-authenticated user can use functions of standalone POD to which access should be restricted. This may result in an escalation of privileges.

This issue only exists when the POD is being opened via a standalone URL. After logging out of such POD by clicking the logout link the user session might sometimes stay open. The next user working on that PC will be able to open the POD under the credentials of the first user without having to log in. Clicking the logout link twice, instead of once, always closes the session.

CVSS Information
CVSS Base Score:  3.6
CVSS Base Vector: AV:L/AC:L/AU:N/C:P/I:P/A:N

SAP provides this CVSS base score as an estimate of the risk posed by the issue reported in this note. This estimate does not take into account your own system configuration or operational environment. It is not intended to replace any risk assessments you are advised to conduct when deciding on the applicability or priority of this SAP security note. For more information, see the FAQ section at https://service.sap.com/securitynotes/.