SAP security note 1716640, "Missing Authorization Check in FS-RI", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Authenticated users can utilize FS-RI functionalities that should be restricted, resulting in possible escalation of privileges.
Solution
Apply SAP Security Note 1716640 to ensure that necessary authorizations are enforced within FS-RI. This includes both automatic authorizations and manual pre-implementation and post-implementation tasks.
Reason and prerequisites
FS-RI lacks proper authorization checks for specific functions, which can cause unintended system behavior.
Affected components
- FS-RI: 472, 600, 650, 660, 670, 680
Full note on SAP: SAP Support Launchpad note 1716640
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].