Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

CVE-2018-2419 Missing Authorization check in SAP Enterprise Financial Services, SAP security note 2596627

SAP Note 2596627
SAP Security Note
Low priority

SAP security note 2596627, "[CVE-2018-2419] Missing Authorization check in SAP Enterprise Financial Services", is a program error note released on 08.05.2018. Below are the symptom and SAP recommended solution.

ComponentIS-B-BCA-MD (Industry-Specific Components > Bank > Bank Current Accounts > Master Data)
CategoryProgram error
PriorityCorrection with low priority
TypeSAP Security Note
Version7
StatusReleased for Customer
Released on08.05.2018
LanguageEnglish

Description

Symptom

SAP Enterprise Financial Services do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

  • Abuse functionality restricted to a particular user group
  • Read, modify, or delete restricted data

Solution

Please implement the attached correction instruction using transaction SNOTE.

Reason and prerequisites

The reason for the vulnerability is a program error. It only exists if business function EAFS_BCA_BUSOPR is active.

CVSS

Score 3.7 Vector: AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

References

  • CVE: CVE-2018-2419

Full note on SAP: SAP Support Launchpad note 2596627

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#IS-B-BCA-MD #Bank Current Accounts #Missing Authorization Check #Enterprise Financial Services

Explore More