Potential information disclosure in incident management, SAP security note 1804016

SAP security note 1804016, “Potential Information Disclosure in Incident Management”, is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

• Component: Incident Management
• Module: Incident Recording

Incident tasks can potentially reveal confidential information about persons involved in incidents to users who do not have the appropriate access levels assigned.

Solution

• Applying the Support Packages listed below that contain the necessary corrections.
• Implementing the Correction Instructions provided in this SAP Note.

Reason and prerequisites

Reason: Program error.

Prerequisites: ensure the following SAP Notes are implemented before applying this Note:

• 1637741 – Injury/Illness tab is not hidden for restricted users
• 1721648 – Additional authorization check for incident links
• 1758151 – Disabling pushbuttons for closed and void incidents
• 1802680 – Potential information disclosure in incident tasks
• 1754662 – New cross BO functionality for Risk Assessment

References