Missing Authorization check of Individual Conditions, SAP security note 2357695

SAP security note 2357695, "Missing Authorization check of Individual Conditions", is a program error note released on September 13, 2016. Below are the symptom, SAP recommended solution and CVSS score.

Description

Symptom

Individual Conditions in Account Management do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

The affected functions have now been enforced to properly check access restrictions. Please implement the correction instructions provided in the SAP Note.

CVSS

Score 5.4 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N