SAP Security Note
Medium priority
SAP security note 2734675, "Missing Authorization Check in SAP Cash Management", is a program error note released on 10.12.2019. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use certain functions of SAP Cash Management to which access should be restricted. This may result in an escalation of privileges.
The following RFC functions are missing display authority checks: BAPI_FCLM_BAM_AMD_BNKANT, BAPI_HOUSE_BANK_REPLICATE, FQM_DISTRIBUTE, TRCM_FDES_IMPORT.
Solution
- Function Module Adjustment: launch transaction SE37 and edit the function module
FQM_REBUILD_MMPO_MULTITASKING. Switch to the attributes tab and change the processing type to ‘Regular Function Module’. Save and activate the changes. - Apply the correction instructions for SAP_FIN and S4CORE.
Reason and prerequisites
SAP Cash Management does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may lead to undesired system behavior.
CVSS
Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected components
- SAP_FIN: Versions 720, 730
- S4CORE: Versions 100, 101, 102, 103
- SAPSCORE: Version 116
- S4CORE: Versions 100 to 103
Full note on SAP: SAP Support Launchpad note 2734675
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].