Missing authorization check in Loans Management, SAP security note 1583301

SAP security note 1583301, "Missing Authorization Check in Loans Management", is a note released on September 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of Loans Management to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the correction of the note or implement the actual Support Package.

Reason and prerequisites

Loans Management does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

References

Affected components

• EA-FINSERV: 110, 200, 500, 600, 603, 604, 605
• BANK/CFM: 463_20