Skip links
RedRays
Published in: sap note

Missing Authorization check in Manage Substitutions – Products and Manage Exclusions – Products, SAP security note 2973100

Author
Published on:

Description

Manage Substitutions – Products and Manage Exclusions – Products does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

 Some well-known impacts of Missing Authorization check are –

  • abuse functionality restricted to a particular user group
  • modify restricted data

Available fix and Supported packages

  • S4CORE | 105 | 105
  • | SAPK-S4CLOUD_2011 |
  • S4CORE 105 | SAPK-10501INS4CORE |

Affected component

    CA-ATP-SUB
    ATP: Master Data Substitution

CVSS

Score: 3.6
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2973100

TAGS

#Access-control
#Authorization-error
#Authorization-profile
#&160-Master-Data—Product-Substitution
#Product-Substitution
#Product-Exclusion
#F4785
#F4786
#CA-ATP-SUB

You may also like