SAP security note 1909770, "Missing whitelist check in SAP Collections Management". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of SAP Collections Management to send correspondence from process receivables to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the correction instructions. The manual activity described here is optional. Without the manual correction, the system will just display the message number "UDM_MSG:219".
For detailed correction instructions, visit https://me.sap.com/corrins/0001909770/15843 and https://me.sap.com/corrins/0001909770/205.
Reason and prerequisites
SAP Collections Management while sending correspondence from process receivables does not contain required checks against a positive set of allowed functions (i.e., whitelist) during the execution of these functions. This is required to verify that authenticated users are allowed to access these functions. The missing check may result in undesired system behavior.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1909770
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
