Missing authorization check in XX-PROJ-FI-CA, SAP security note 2251513

SAP security note 2251513, “Missing authorization check in XX-PROJ-FI-CA”, is a program error note released on 27.09.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can access functions of XX-PROJ-FI-CA, even though access to these functions should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instructions or import the specified Support Package.

Reason and prerequisites

XX-PROJ-FI-CA does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 0

Affected components

• FI-CA 600
• FI-CA 602
• FI-CA 603
• FI-CA 604
• FI-CA 605
• FI-CA 606
• FI-CA 616
• FI-CA 617
• FI-CA 618
• FI-CA 800