Skip links

Missing authorization check in Loans Management, SAP security note 2491578

Description

Loans Management does not execute the required authorization checks for an authenticated user, which may result in an escalation of privileges.

 The known effects of the missing authorization check include:

  • Fraudulent or incorrect use of functions the use of which should be restricted to certain user groups
  • Ability to read, modify or delete data, to which access should be restricted.

Available fix and Supported packages

  • SAPSCORE | 110 | 110
  • S4CORE | 101 | 101
  • S4CORE | 102 | 102
  • EA-FINSERV | 617 | 617
  • EA-FINSERV | 618 | 618
  • EA-FINSERV | 800 | 800
  • | SAPK-S4CLOUD_1711 |
  • S4CORE 101 | SAPK-10103INS4CORE |
  • S4CORE 102 | SAPK-10201INS4CORE |
  • EA-FINSERV 800 | SAPK-80005INEAFINSRV |
  • EA-FINSERV 617 | SAPK-61715INEAFINSRV |
  • EA-FINSERV 618 | SAPK-61808INEAFINSRV |

Affected component

    FS-CML
    Consumer and Mortgage Loans

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2491578

TAGS

#Authorization
#authorization-check