Missing Authorization Check in S4 ACR Brazil Option, SAP security note 2874738

SAP security note 2874738, “Missing Authorization Check in S4 ACR Brazil Option”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Reports for Brazil do not perform required authorization checks, allowing abuse of functionality restricted to specific user groups and unauthorized access to restricted data.

Solution

Apply this SAP Security Note, or the corresponding Support Package for your S4CORE release, to add the missing authorization checks.

After implementing this note, the following reports include proper authorization checks:

• EFD ICMS IPI Report (/TMF/EFD_REPORT)
• ECF Report (/TMF/ECF_REPORT)
• ECD Report (/TMF/ECD_REPORT)
• EFD-Contribuições Report (/TMF/PCO)

CVSS

Score 3.8 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L

Affected components

• S4CORE 103
• S4CORE 104