Missing authorization check in FI-AP-AP-B1, SAP security note 2219924

SAP security note 2219924, "Missing authorization check in FI-AP-AP-B1", is a program error note released on 13.10.2015. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of FI-AP-AP-B1 to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instructions from the respective notes or upgrade to the relevant support package.

• SAP_APPL 617-700: SAP Note 1983443
• SAP_APPL 600-616: SAP Note 2215605
• SAP_APPL 46C-500: SAP Note 2219924

Reason and prerequisites

FI-AP-AP-B1 does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This oversight may lead to undesired system behavior and potential privilege escalation.

CVSS

Score 4.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

References

• SAP Note 2215605 – Missing authorization check in FI-AP-AP-B1
• SAP Note 1983443 – Missing authorization check in FI-AP-AP-B1

Affected components

• SAP_APPL 46C
• SAP_APPL 470
• SAP_APPL 500