SAP security note 2368873, "Missing Authorization check in Banking Services / Standing Order", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Banking Services / Standing Order does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Some well-known impacts of a missing authorization check include:
Abuse of functionality restricted to a particular user group.
Reading, modifying, or deleting restricted data.
Solution
The employee authority check must be performed in addition to the usual authority check.
Reason and prerequisites
The problem only exists if the "employee authority check" is activated on the account level.
CVSS
Score 5.4 / 10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2368873
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].