SAP Security Note
Low priority
SAP security note 2307916, "Missing Authorization check in component CRM-BF-PC", was released on 10.07.2018. Below are the symptom and SAP recommended solution.
Description
Symptom
CRM-BF-PC does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
It is possible to insert a new card to sales orders even though the authority object CRM_ORD_PC is not granted.
Solution
Implement the attached correction instruction.
Please check and, if necessary, adopt your roles with the authorization object and the corresponding values listed below:
- CRM_ORD_PC: ACTVT=01,02
Reason and prerequisites
Program error.
Full note on SAP: SAP Support Launchpad note 2307916
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
