SAP security note 1864081, “Missing Authorization Check in TRM Transaction Management”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of FIN-FSCM-TRM-TM to which access should be restricted. This may result in an escalation of privileges.
Solution
Follow the correction instructions provided below.
Reason and prerequisites
Fin-FSCM-TRM-TM does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
CVSS
Score 2.1 Vector: AV:N/AC:H/AU:S/C:N/I:P/A:N
Affected components
- EA-FINSERV 600
- EA-FINSERV 603
- EA-FINSERV 604
- EA-FINSERV 605
- EA-FINSERV 606
- EA-FINSERV 616
- EA-FINSERV 617
Full note on SAP: SAP Support Launchpad note 1864081
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].