SAP Missing Authorization Check Vulnerability in Remote-Enabled Function Module

A vulnerability exists in certain SAP products due to a missing authorization check. This flaw allows an authenticated user with non-administrative privileges to invoke a remote-enabled function module. Exploitation of this vulnerability could lead to unauthorized access to restricted information, causing a low impact on confidentiality. The vulnerability does not affect integrity or availability.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information, bypassing normal access controls.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP for Me platform, specifically in the Security Notes section. For details on the next SAP Security Patch Day, refer to the SAP Security Patch Day Bulletin.