SAP Note 1558284
HotNews
HotNews
SAP security note 1558284, “Missing authorization check in HR Distributed-Reporting”, released on April 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can exploit functions in HR Distributed-Reporting without proper authorization checks, potentially escalating privileges.
Solution
Implement the Business Add-In (BAdI) HRPAD00AUTH_DIST as per SAP Note 1531288. Alternatively, apply the corresponding Support Package SAPK-60433INSAPHRRXX.
CVSS
Score 8.2 Vector: AV:N/AC:M/AU:S/C:C/I:C/A:P
References
This note refers to
Affected components
- Payroll > Payroll: General Parts (PY-XX)
Full note on SAP: SAP Support Launchpad note 1558284
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
