SAP S/4HANA Manage Bank Statements Access Control Vulnerability Allowing Attachment Deletion

A vulnerability exists in the Manage Bank Statements feature of SAP S/4HANA, where insufficient access control checks allow authenticated users to illegitimately delete attachments from posted bank statements. This flaw results in a low integrity impact, with no effect on data confidentiality or application availability.

Impact

Exploitation of this vulnerability leads to unauthorized deletion of attachments from posted bank statements, causing a low integrity impact.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP for Me platform, specifically in the Security Notes section.