SAP S/4HANA Defense & Security Missing Authorization Check Vulnerability Allowing Unauthorized Database Updates

A vulnerability exists in SAP S/4HANA Defense & Security due to a missing authorization check in the Disconnected Operations feature. This flaw allows an attacker with user privileges to invoke remote-enabled function modules, enabling direct updates to standard SAP database tables. The vulnerability has a low impact on data integrity, with no effects on the application's confidentiality or availability.

Impact

Exploitation of this vulnerability allows for unauthorized direct modifications to standard SAP database tables, potentially leading to data integrity issues.

Remediation

Users are advised to consult the SAP Security Notes for guidance on applying necessary patches. SAP Security Notes can be accessed through the SAP for Me platform, specifically on the SAP Security Patch Day.