Missing authorization check in coinsurance reporting, SAP security note 1473520

SAP security note 1473520, "Missing authorization check in coinsurance reporting", is a program error note released on 19.07.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This note is relevant only if you use the application component FS-CD (software component INSURANCE). If you do not use these components, you are not affected by the problem and you do not have to implement this note.

It is possible to call certain functions of coinsurance reporting without the user that is logged on having the required prerequisite authorization. This may result in an escalation of privileges.

Solution

The source code is no longer used by the FS-CD standard system and this note turns it into a comment.

Reason and prerequisites

In FS-CD coinsurance reporting, the authorization check that controls access to functions is missing. Without the checks, the user that is logged on can easily call these functions, which may result in an unwanted change to the system response.

References

Affected components

• INSURANCE 464
• INSURANCE 471
• INSURANCE 472
• INSURANCE 600
• INSURANCE 602
• INSURANCE 603
• INSURANCE 604
• INSURANCE 605