SAP security note 1327917, “Authorization check for transactions FPSEC1/FPSEC2/FPSEC3”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
You can access transactions FPSEC1 (Create Security Deposit), FPSEC2 (Change Security Deposit), and FPSEC3 (Display Security Deposit) even though you do not have the required authorization. The system did not execute the authorization check for the "Transaction" object (S_TCODE).
Solution
You can implement the solution in advance by importing the add-on releases that are specified in the validity section of this note. The corrections are also delivered in the latest Add-On Support Package.
Reason and prerequisites
This function was not previously provided.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1327917
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].