Skip links

Missing Authorization check in EHS Task Definition attachments, SAP security note 2873099

Description

UPDATE 10th November 2020: This note has been re-released with updated ‘Correction instruction’ information. We added the prerequisite note 2697309 in the correction instruction 683173 for S4CORE 103.

The Manage Task Definition (F2528), Manage Change Request Task (F3415) and Manage Maintenance Notification Task (F3415) applications do not perform the necessary authorization checks for an authenticated user, resulting in escalation of privileges for attachments related to a task definition.

Some well-known impacts of missing authorization checks are:

  • abusing functionality, restricted to a particular user group
  • reading, modifying or deleting restricted data    

Available fix and Supported packages

  • SAPSCORE | 119 | 119
  • S4CORE | 103 | 103
  • S4CORE | 104 | 104
  • | SAPK-S4CLOUD_2005 |
  • SAPSCORE 119 | SAPK-11907INSAPSCORE |
  • S4CORE 103 | SAPK-10304INS4CORE |
  • S4CORE 104 | SAPK-10402INS4CORE |

Affected component

    EHS-SUS-FND
    Sustainability Foundation

CVSS

Score: 5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2873099

TAGS

#Access-control
#Authorization-error
#Authorization-profile
#Attachments