Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Authorization check for RFC in SAP Finance Transaction Manager, SAP security note 2473860

SAP Note 2473860
SAP Security Note
Medium priority

SAP security note 2473860, "Authorization check for RFC in SAP Finance Transaction Manager", is a program error note released on 17.01.2019. Below are the symptom and SAP recommended solution.

ComponentFinancials > Financial Supply Chain Management > Treasury and Risk Management > Transaction Manager
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released on17.01.2019
LanguageEnglish

Description

Symptom

FIN-FSCM-TRM-TM does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of missing authorization checks include:

  • Abuse of functionality restricted to a particular user group
  • Read, modify, or delete restricted data

Solution

New authorization checks have been implemented.

CVSS

Score 4.3 Vector: CVSS:/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Full note on SAP: SAP Support Launchpad note 2473860

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Access control #Authorization check #Authorization #RFC

Explore More