CVE-2019-0276 Inadequate Authorization check in Banking services from SAP and SAP S/4HANA Financial Products Subledger, SAP security note 2754235

SAP security note 2754235, "[CVE-2019-0276] Inadequate Authorization Check in Banking Services", is a note released on 12.03.2019. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Smart Accounting performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges.

Some well-known impacts of missing authorization checks include:

• Abuse of functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

Please implement the correction instructions provided in the SAP Security Note. Users who should be able to run report /BA1/RBR_LGENT_NUMBER_RANGE now need:

• Authorization for S_NUMBER for any number range
• Authorization for S_TABU_NAM for table /BA1/TBR_NRSODOC

Reason and prerequisites

A check on authorization object S_TABU_DIS is done, and if it fails, the processing is stopped. This is too strict because an alternative check against S_TABU_NAM is missing.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected components

• Financial Services > Financial Products Subledger > Subledger Accounting (FS-FPS-SLA)
• Financial Services > Bank Analyzer > Processes & Methods > Smart Accounting for Financial Instruments (FS-BA-PM-SFA)