Missing authorization check in segmentation service SGS, SAP security note 1514018

SAP security note 1514018, "Missing authorization check in segmentation service SGS", is a program error note released on 14.12.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

Certain functions of Bank Analyzer Segmentation Service FS-BA-TO-SGS can be called even though the user that is logged on does not have the required authorization. This may result in an escalation of privileges.

Solution

The authorization check has been implemented. Implement the attached corrections.

Reason and prerequisites

In the segmentation service FS-BA-TO-SGS, the authorization checks that control access to functions are missing. Without these checks, the user that is logged on can easily call these functions, which may result in an unwanted change to the system response.