title: Missing Authorization Check in Vendor Master Hierarchy
description: Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4CORE 100, does not perform necessary authorization checks for an authenticated user to access some of its function. This could lead to modification of data impacting the integrity of the system.
problem types: CWE-862: Missing Authorization
affected:
{
defaultStatus: unaffected
product: Vendor Master Hierarchy
vendor: SAP_SE
versions:
status: affected, version: SAP_APPL 500
status: affected, version: SAP_APPL 600
status: affected, version: SAP_APPL 602
status: affected, version: SAP_APPL 603
status: affected, version: SAP_APPL 604
status: affected, version: SAP_APPL 605
status: affected, version: SAP_APPL 606
status: affected, version: SAP_APPL 616
status: affected, version: SAP_APPL 617
status: affected, version: SAP_APPL 618
status: affected, version: S4CORE 100
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL