Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in SAP Funding Management, SAP security note 2776558

SAP Note 2776558SAP Security NoteHigh priority

SAP security note 2776558, "Missing authorization check in SAP Funding Management", was released on 23.04.2019. Below are the symptom and the SAP recommended solution.

ComponentFinancial Services > Funding Management (FS-TXS)
PriorityHigh priority
TypeSAP Security Note
Version1
StatusReleased for Customer
Released on23.04.2019
LanguageEnglish

Description

Symptom

SAP Funding Management does not execute the required authorization checks for an authenticated user, which may result in an escalation of privileges.

The known effects of the missing authorization check include:

  • Fraudulent or incorrect use of functions the use of which should be restricted to certain user groups
  • Ability to read, modify or delete data, to which access should be restricted.

Solution

The missing checks have been added.

Reason and prerequisites

Program error

CVSS

Score 8.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Full note on SAP: SAP Support Launchpad note 2776558

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Funding Management#Authorization Check#Financial Services#FS-TXS

Explore More