Missing authorization check in Accounting BAPIs, SAP security note 1906927

SAP security note 1906927, "Missing authorization check in Accounting BAPIs". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of Accounting BAPIs to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instructions in your system and carry out the described manual steps.

Reason and prerequisites

Accounting BAPIs do not contain authorization checks for checking an authenticated user’s authorization to access some of their functions. This may result in undesired system behavior.

CVSS

Score 4.9 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:N

References

• 1923728 – SACF scenarios for RFC postings in FI
• 1908870 – SACF | Workbench for switchable authorization scenarios
• 1882417 – External check for Remote Function Call