title: Missing authorization check in SAP BAM (Bank Account Management)
description: SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low impact on confidentiality, integrity and availability of the application.
problem types: CWE-862: Missing Authorization
affected:
{
defaultStatus: unaffected
product: SAP BAM (Bank Account Management)
vendor: SAP_SE
versions:
status: affected, version: SAP_FIN 618
status: affected, version: SAP_FIN 730
status: affected, version: S4CORE 100
status: affected, version: 101
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL