SAP Human Capital Management for SAP S/4HANA Authorization Check Vulnerability Allowing Sensitive Information Disclosure

A vulnerability exists in SAP Human Capital Management for SAP S/4HANA during authorization checks, where the system inadvertently reveals specific messages. This flaw enables an authenticated user with low privileges to guess and enumerate information beyond their authorized access, leading to the disclosure of sensitive data and causing a significant breach of confidentiality. However, integrity and availability remain unaffected.

Impact

Exploitation of this vulnerability could result in unauthorized disclosure of sensitive information.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform, specifically in the 'Security Notes' section. It is recommended to implement these security corrections as a priority.