Missing Authorization check in FS-CMS, SAP security note 2473452

SAP security note 2473452, "Missing Authorization Check in FS-CMS", is a program error note released on June 14, 2018. Below are the symptom, SAP recommended solution, affected software components and related references.

Description

Symptom

SAP Note 2473452 addresses a critical authorization issue in the Financial Services Collateral Management (FS-CMS) module. The note highlights that FS-CMS does not perform necessary authorization checks for authenticated users, which can lead to privilege escalation. This vulnerability allows unauthorized users to abuse functionalities restricted to specific user groups and perform unauthorized read, modify, or delete operations on restricted data.

Solution

To resolve the authorization issue, follow these steps:

• Implement Correction Instructions: follow the manual steps provided in the Correction Instructions section of the SAP Note to create the necessary DDIC objects and enforce proper access restrictions.
• Apply Relevant Support Packages: update your system with the appropriate support packages listed under the Support Package section to ensure all changes are integrated.

References

• 2543578 – FS-CMS: Receivable and Rights creation using BAPI fails due to missing business activity
• 2546229 – Current Account Cancellation is not replicated from AM to CMS system
• 2682724 – Error in implementing note 2473452

Affected components

• FSAPPL: Versions 200, 300, 400, 500
• SAPSCORE: Version 110
• S4CORE: Version 101
• EA-FINSERV: Versions 600, 603, 604, 605, 606, 616, 617, 618, 800