Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing Authorization check in DFPS stock transfer process, SAP security note 2530147

SAP Note 2530147
SAP Security Note
Medium priority

SAP security note 2530147, "Missing Authorization Check in DFPS Stock Transfer Process", is a program error note released on 20.11.2018. Below are the symptom and SAP recommended solution.

ComponentIS-DFS-MM-STO
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version1
StatusReleased for Customer
Released on20.11.2018
LanguageEnglish

Description

Symptom

In the DFPS stock transfer process, the system does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Impacts of Missing Authorization Check:

  • Abuse functionality restricted to a particular user group
  • Read, modify, or delete restricted data

Solution

The affected functions have now been enforced to properly check access restrictions. Please implement the correction instructions.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Full note on SAP: SAP Support Launchpad note 2530147

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Access control #Authorization error #Authorization profile

Explore More