Missing authorization check in CRM-BTX-LEA, SAP security note 2271740

SAP security note 2271740, "Missing authorization check in CRM-BTX-LEA", is a program error note released on 11.10.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of CRM-BTX-LEA to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached Correction Instructions, or apply the corresponding BBPCRM Support Package to resolve this issue.

Reason and prerequisites

CRM-BTX-LEA does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

Affected components

• BBPCRM 600, 700, 701, 702, 712, 713, 714