Skip links

Missing authorization check in standalone POD in Manufacturing Execution, SAP security note 2013080

Description

A non-authenticated user can use functions of standalone POD to which access should be restricted. This may result in an escalation of privileges.

This issue only exists when the POD is being opened via a standalone URL. After logging out of such POD by clicking the logout link the user session might sometimes stay open. The next user working on that PC will be able to open the POD under the credentials of the first user without having to log in. Clicking the logout link twice, instead of once, always closes the session.

CVSS Information
CVSS Base Score:  3.6
CVSS Base Vector: AV:L/AC:L/AU:N/C:P/I:P/A:N

SAP provides this CVSS base score as an estimate of the risk posed by the issue reported in this note. This estimate does not take into account your own system configuration or operational environment. It is not intended to replace any risk assessments you are advised to conduct when deciding on the applicability or priority of this SAP security note. For more information, see the FAQ section at https://service.sap.com/securitynotes/.

Available fix and Supported packages

  • SAPMECORE | 6.1 | 6.1
  • SAPMECORE | 15.0 | 15.0
  • SAP MFG EXECUTION CORE 15.0 | SP000 | 000000
  • SAP MFG EXECUTION CORE 6.1 | SP004 | 000016

Affected component

    MFG-ME
    SAP Manufacturing Execution

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2013080

TAGS

#MFG-ME
#Manufacturing-Execution
#6.1
#POD
#Production-Operator-Dashboard
#Logout
#Login
#Standalone-URL
#Session
#Authorization
#authorization-check