Missing Authorization check in EWM for delivery / warehouse request objects, SAP security note 2316942

Description

A user can change delivery/warehouse request objects even if he has no change authorization.

Available fix and Supported packages

SCMEWM | 940 | 940
SCMEWM 940 | SAPK-94001INSCMEWM |

Affected component

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2316942

TAGS

#Access-control
#Authorization-error
#Authorization-profile
#/SCDL/AF061
#/SCDL/AF-061

More to explorer

RedRays Offers Support to Startups Listing on SAP Store

February 26, 2023

RedRays is a startup that was founded in January 2021. Throughout our journey, we have been fortunate to receive support and guidance

Threat Modeling: An Overview of PASTA Methodology

February 23, 2023

I would like to briefly introduce the Threat Modeling methodology in this blog post. This will be the initial part of the

SAP Security Patch Day – February 2023

February 14, 2023

SAP Security Patch Day is a monthly event during which SAP releases security updates for their software products. These updates address potential

3242933 – [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution

October 12, 2022

General information Risk: CRITICAL Versions Affected:SAP MFG EXECUTION CORE 15.1SAP MFG EXECUTION CORE 15.2SAP MFG EXECUTION CORE 15.3Vendor URL: https://sap.comBug: File path traversal

Arpine Maghakyan