Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing Authorization check in TSW Supply Chain Visualization, SAP security note 2756551

SAP Note 2756551
SAP Security Note
Medium priority

SAP security note 2756551, “Missing Authorization check in TSW Supply Chain Visualization”, is a program error note released on 11.08.2020. Below are the symptom and SAP recommended solution.

ComponentIndustry-Specific Components > Oil > Downstream > Traders and Schedulers Workbench
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released on11.08.2020
LanguageEnglish

Description

Symptom

TSW Supply Chain Visualization does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Impacts of Missing Authorization Check:

  • Abuse functionality restricted to a particular user group
  • Read, modify, or delete restricted data

Solution

Authorization checks have been introduced. Implement the attached correction instructions to resolve the issue.

Reason and prerequisites

Shipment Visualization application shows unauthorized locations in the geomap.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Full note on SAP: SAP Support Launchpad note 2756551

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#TSW #Supply Chain Visualization #Traders and Schedulers Workbench #Oil Downstream

Explore More