SAP security note 2469377, "Missing Authorization check in CIAP". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
UPDATE 18th September 2018: This note has been re-released with updated Correction Instructions information.
CIAP functionality does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Abuse functionality restricted to a particular user group.
Read, modify or delete restricted data.
Solution
As a general rule, SAP recommends that you install a solution by applying a Support Package. However, if you need to install a solution earlier, use the Note Assistant to implement the correction instruction. Note that documentation, transactions, and Customizing activities are only delivered via Support Package.
With this SAP Note, new authorization checks are performed in the CIAP transactions. To implement the solution, you must implement the correction instructions that are valid for your release.
Reason and prerequisites
This is an SAP Tax Declaration Framework note. If you do not have SAP TDF installed in your system, this note does not apply to you. SAP TDF requires a specific license. This SAP Note is relevant only for Brazil. You have implemented SAP Note 2470078.
CVSS
Score 6.3 / 10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
This note refers to
Referenced by
Affected components
- SAP_APPL 605 to 618
- S4CORE 100 to 101
Full note on SAP: SAP Support Launchpad note 2469377
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].