Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in FI-AP-AP-B1, SAP security note 1983443

SAP Note 1983443

SAP security note 1983443, "Missing authorization check in FI-AP-AP-B1". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of FI-AP-AP-B1 to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instructions from the respective note as mentioned below or upgrade to the relevant support package.

Reason and prerequisites

FI-AP-AP-B1 does not contain authorization checks for verifying an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 4.0 / 10 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

References

Full note on SAP: SAP Support Launchpad note 1983443

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization Check#FI-AP-AP-B1#Privilege Escalation#Accounts Payable

Explore More