description: The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
problem types: Missing Authorization Check
affected:
{
product: SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)
vendor: SAP SE
versions:
status: affected, version: < 600
status: affected, version: < 603
status: affected, version: < 604
status: affected, version: < 605
status: affected, version: < 606
status: affected, version: < 616
status: affected, version: < 617
status: affected, version: < 618
status: affected, version: < 800
}
{
product: SAP Treasury and Risk Management (Transaction Management) (S4CORE)
vendor: SAP SE
versions:
status: affected, version: < 101
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.0
]