SAP security note 2192350, "Missing Authorization Check in Transportation Management". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can exploit functions within SAP Transportation Management that should have restricted access, potentially leading to privilege escalation.
Solution
To address this vulnerability, apply the relevant Correction Instruction or Support Package applicable to your SAPTM version.
After implementing the Correction Instruction or Support Package, ensure you also apply SAP Note 2204353 to prevent runtime errors (GETWA_NOT_ASSIGNED) when deleting schedules.
Reason and prerequisites
The Transportation Management module does not perform necessary authorization checks for certain functions. This vulnerability allows users with basic access to perform actions beyond their intended permissions, resulting in undesired system behavior.
CVSS
Score 3.5 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected components
- SAPTM 110
- SAPTM 120
- SAPTM 130
- SAPTM 140
Full note on SAP: SAP Support Launchpad note 2192350
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].