Medium priority
SAP security note 2646067, "[CVE-2018-2455] Missing Authorization check in SAP Enterprise Financial Services", is a note released on 11.09.2018. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Enterprise Financial Services does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Some well-known impacts of missing authorization checks include:
- Abuse of functionality restricted to a particular user group
- Ability to read, modify, or delete restricted data
Solution
The affected functions have been updated to properly enforce access restrictions. Implement the attached correction instructions using transaction SNOTE.
Reason and prerequisites
The vulnerability is a result of a program error and exists only if the business function EAFS_BCA_BUSOPR_SEPA is active.
CVSS
Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- CVE-2018-2455
- SAP Security Notes
Full note on SAP: SAP Support Launchpad note 2646067
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
