SAP Security Note
High priority
SAP security note 1590888, "Missing assignment of authorization group to FAGLFLEXA/T", is a program error note released on 12.07.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions like SE16, SE16N, or SQ01 to access information stored in tables FAGLFLEXA and FAGLFLEXT.
Solution
Apply support package or assign authorization group FA through SE11.
Reason and prerequisites
Currently there is no authorization group assigned to FAGLFLEXA and FAGLFLEXT. This missing assignment is inconsistent with respect to other tables storing financial accounting information like BKPF and BSEG.
CVSS
Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N
Full note on SAP: SAP Support Launchpad note 1590888
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].