Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

CVE-2020-6214 Incorrect Authorization in SAP S/4HANA (Financial Products Subledger), SAP security note 2897612

SAP Note 2897612
SAP Security Note
Medium priority

SAP security note 2897612, “[CVE-2020-6214] Incorrect Authorization in SAP S/4HANA (Financial Products Subledger)”, is a program error note released on 14.04.2020. Below are the symptom and SAP recommended solution.

ComponentFinancial Services > Financial Products Subledger (FS-FPS)
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version9
StatusReleased for Customer
Released on14.04.2020
LanguageEnglish

Description

Symptom

SAP S/4HANA for Financial Products Subledger uses an incorrect authorization object in some reports. Although the affected reports are protected with other authorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties.

Solution

Incorrect authorization object in vulnerable reports is replaced with the appropriate object. Please apply the automatic correction instruction available here.

CVSS

Score 4.7 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Full note on SAP: SAP Support Launchpad note 2897612

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#S4FPSL #privilege escalation #authorization error #business role #incorrect authorization check #CVE-2020-6214

Explore More