Missing authorization check in FI-CA, SAP security note 1934633

SAP Note 1934633

SAP security note 1934633, "Missing authorization check in FI-CA". Below are the symptom, SAP recommended solution and the affected software components.

ComponentFI-CA

Description

Symptom

An authenticated user can use functions of FI-CA to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the corrections as per the Correction Instructions, or import the relevant Support Package corresponding to your FI-CA version.

CVSS

Score 6.5 Vector: AV:N/AC:L/AU:S/C:P/I:P/A:P

Affected components

FI-CA 471 to 617

Full note on SAP: SAP Support Launchpad note 1934633

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#FI-CA #Authorization Check #Escalation of Privileges #SAP Security Note