Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in CRM-MD-INB, SAP security note 2263882

SAP Note 2263882
SAP Security Note
Medium priority

SAP security note 2263882, "Missing authorization check in CRM-MD-INB", is a program error note released on 05.11.2016. Below are the symptom, SAP recommended solution and the affected software components.

ComponentCRM-MD-INB (Customer Relationship Management > Master Data > Installed Bases)
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version1
StatusReleased for Customer
Released on05.11.2016

Description

Symptom

An authenticated user can use functions of CRM-MD-INB to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instructions provided in the SAP Security Note.

Reason and prerequisites

CRM-MD-INB does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This oversight may lead to undesired system behavior and potential security vulnerabilities.

Affected components

  • BBPCRM 700
  • BBPCRM 701
  • BBPCRM 702
  • BBPCRM 712
  • BBPCRM 713
  • BBPCRM 714

Full note on SAP: SAP Support Launchpad note 2263882

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #authorization check #CRM-MD-INB

Explore More