SAP S/4HANA Frontend OData Service Authorization Vulnerability Allowing Unauthorized Entity Modification

A vulnerability exists in the SAP S/4HANA frontend OData Service 'Manage Reference Structures' due to inadequate authorization checks. This flaw enables an attacker to update and delete child entities through the exposed OData services without proper authorization. The vulnerability significantly compromises data integrity, while leaving confidentiality and availability unaffected.

Impact

Exploitation of this vulnerability allows for unauthorized updates and deletions of child entities via the affected OData service, leading to a high impact on data integrity.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform.