Missing authorization checks in LO-BM, SAP security note 2025974

SAP security note 2025974, "Missing authorization checks in LO-BM", is a note. Below are the symptom and the SAP recommended solution.

Description

Symptom

An authenticated user can use functions of the following RFC function modules to which access should be restricted. This may result in an escalation of privileges.

• PRE_RELATION_ADD_FRC
• VBXR_MATERIAL_CBATP_ADJUST
• VBHT_INDEX_READ (ab EhP4)

Solution

Implement this SAP Note or import the relevant Support Package to address the missing authorization checks.

Reason and prerequisites

The mentioned function modules do not contain authorization checks for verifying an authenticated user’s authorization to access some of their functions. This may result in undesired system behavior.

References

• Further improvements for RFC security