SAP Security Note
High priority
SAP security note 1853756, “Missing Authorization Check in eAccounting”, is a program error note released on 09.07.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of eAccounting (FIN-BAC-AE and FIN-FB-SRV) to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the attached correction instructions.
Reason and prerequisites
eAccounting (FIN-BAC-AE and FIN-FB-SRV) does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.
CVSS
Score 0
Affected components
- FINBASIS: 600, 602, 603, 604, 605, 634, 700, 736, 746, 747
- SEM-BW: 400, 600, 602, 603, 604, 605, 634, 700, 736, 746, 747
Full note on SAP: SAP Support Launchpad note 1853756
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
