Missing Authorization check in Commodity Risk Management (Maintenance of Commodity Curves), SAP security note 2498083

SAP security note 2498083, "Missing Authorization check in Commodity Risk Management (Maintenance of Commodity Curves)", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Commodity Management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

Apply the attached Correction Instruction or import the relevant Support Package to your system.

Reason and prerequisites

RFC access to commodity curve data via function unit TPM_TRCO_DCSMD_MAINTAIN does not perform an authorization check. However, accessing commodity curve data using the official transaction code TANCCMASTER performs an authorization check. This means that users working with commodity curves already have the necessary authorizations for transaction TPM_TRCO_DCSMD. In cases where customers programmatically call the function unit TPM_TRCO_DCSMD_MAINTAIN, user authorizations might need to be adapted accordingly.

CVSS

Score 6.3 Vector: CVSS:/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected components

• S4CORE 101
• S4CORE 102
• EA-FINSERV 617
• EA-FINSERV 618
• EA-FINSERV 800