Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
[
{
"product": "SAP Treasury and Risk Management (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "< 1.01"
},
{
"status": "affected",
"version": "< 1.02"
},
{
"status": "affected",
"version": "< 1.03"
},
{
"status": "affected",
"version": "< 1.04"
}
]
},
{
"product": "SAP Treasury and Risk Management (EA-FINSERV)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "< 6.0"
},
{
"status": "affected",
"version": "< 6.03"
},
{
"status": "affected",
"version": "< 6.04"
},
{
"status": "affected",
"version": "< 6.05"
},
{
"status": "affected",
"version": "< 6.06"
},
{
"status": "affected",
"version": "< 6.16"
},
{
"status": "affected",
"version": "< 6.17"
},
{
"status": "affected",
"version": "< 6.18"
},
{
"status": "affected",
"version": "< 8.0"
}
]
}
]