SAP Note 2028501
SAP security note 2028501, "Missing authorization check in PP-SFC-EXE-CON", is a note. Below are the symptom and the SAP recommended solution.
Description
Symptom
RFC enabled function modules allow to access confirmation data without an authority check.
Solution
An authority check for check object C_AFRU_AWK is added. In case you encounter authority check issues with RFC users trying to read confirmation data, please check if the RFC user has the necessary authorization or is supposed to have it.
Reason and prerequisites
Missing authority check.
Full note on SAP: SAP Support Launchpad note 2028501
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
