Skip links

Security risk with logout feature in standalone POD, SAP security note 1987927

Description

This issue only exists when the POD* is being opened via a standalone URL. After logging out of such POD by clicking the logout link the user session might sometimes stay open. The next user working on that PC will be able to open the POD under the credentials of the first user without having to log in. Clicking the logout link twice, instead of once, always closes the session.

CVSS Information
CVSS Base Score:  4.6
CVSS Base Vector: AV:L/AC:L/AU:N/C:P/I:P/A:P

SAP provides this CVSS base score as an estimate of the risk posed by the issue reported in this note. This estimate does not take into account your own system configuration or operational environment. It is not intended to replace any risk assessments you are advised to conduct when deciding on the applicability or priority of this SAP security note. For more information, see the FAQ section at https://service.sap.com/securitynotes/.

Available fix and Supported packages

  • SAPMECORE | 6.1 | 6.1
  • SAP MFG EXECUTION CORE 6.1 | SP003 | 000000
  • SAP MFG EXECUTION CORE 6.1 | SP004 | 000000

Affected component

    MFG-ME
    SAP Manufacturing Execution

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1987927

TAGS

#MFG-ME
#Manufacturing-Execution
#6.1
#POD
#Production-Operator-Dashboard
#Logout
#Login
#Standalone-URL
#Session