Missing authorization check in RFC module, SAP security note 1462417

SAP security note 1462417, "Missing authorization check in RFC module", released on August 10, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Certain functions for setting the administrative location data can be called, even if the user logged on does not have the required authorization for this. This may result in an escalation of privileges.

Solution

You can implement corrections manually or using the Note Assistant before importing the Support Package specified in this note.

The relevant authorization object is not yet available for Release SCM 500. Therefore, the source code has been adjusted so that critical database changes are not executed within the RFC module.

For all subsequent releases, the system checks the authorization object /FRE/AREA that must be assigned to a user to execute transaction /FRE/FRP_ADMIN.

Reason and prerequisites

In an RFC module, authorization checks that regulate access to functions are missing. A user logged on can simply call these functions without these checks, potentially causing unwanted changes to the system behavior.

CVSS

Score 0

References

• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• Supply Chain Management > Forecasting and Replenishment > FRP Functions (SCM-FRE-FRP)