SAP security note 2662687, "[CVE-2018-2484] Missing Authorization check in SAP Enterprise Financial Services", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Enterprise Financial Services does not perform necessary authorization checks for authenticated users, resulting in the potential escalation of privileges. This can lead to unauthorized access and manipulation of restricted functionalities and data.
- Abuse of Restricted Functionality: Users can access and exploit functionalities that should be limited to specific user groups.
- Data Manipulation: Unauthorized users may read, modify, or delete restricted data, compromising data integrity and confidentiality.
Solution
SAP recommends applying the correction referenced in this SAP Security Note and importing all relevant Support Packages for the affected software components.
This correction is known to interact with SAP Note 2893313 (F9H1: Cash Concentration Subnode Screen Can’t Be Cancelled).
CVSS
Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- SAP Note 2662687: Missing Authorization check in SAP Enterprise Financial Services
- SAP Security Patch Day
Affected components
- S4CORE: 101, 102, 103
- EA-FINSERV: 110, 200, 500, 600, 603, 604, 605, 606, 616, 617, 618, 800
- BANK/CFM: 463_20
Full note on SAP: SAP Support Launchpad note 2662687
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].