Missing Authorization Check in Healthcare Business Partner, SAP security note 1519330

SAP security note 1519330, "Missing Authorization Check in Healthcare Business Partner", released on January 31, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

• Unauthorized access to restricted functionalities within the Healthcare Business Partner component.
• Potential escalation of privileges due to missing authorization checks.

Solution

Follow the manual steps provided below to implement the necessary authorization checks:

• Go to transaction SE11 and select the Database Table radio button.
• Repeat steps 3 to 8 for each of the following tables: ISH_NEG_FOODC, ISH_PREF_FOODC, ISH_RISKC, ISH_INSTYPEC, ISH_MEMBTYPEC, ISH_RESPTYPEC.
• In the field Database Table, enter the table name listed above.
• Click on the Display button.
• From the Utilities menu, select Assign Authorization Group.
• From the Table/View menu, choose Display → Change.
• In the Authorization column associated with the corresponding table, change the value from &NC& to CRMC.
• Save your changes.

Reason and prerequisites

The Healthcare Business Partner lacks appropriate permission checks for authenticated users, allowing them to access functionalities without proper authorization. This oversight may result in undesired system behavior and security breaches.

Affected components

• CRM-IPH-BP (500, 510, 520, 600, 700, 701)