Missing authorization check in CRM Sales, SAP security note 1510071

SAP Note 1510071
SAP Security Note
Medium priority

SAP security note 1510071, "Missing authorization check in CRM Sales", is a program error note released on 10.01.2012. Below are the symptom and SAP recommended solution.

ComponentCustomer Relationship Management > Basic Functions > Payment Cards

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released on10.01.2012

Description

Symptom

An authenticated user can use functions of CRM Sales to which access should be restricted. This may result in an escalation of privileges.

Solution

Please implement the attached correction instruction.

Reason and prerequisites

CRM Sales does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

References

Automatic checks for security notes using RSECNOTE (outdated)

Full note on SAP: SAP Support Launchpad note 1510071

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization Check #CRM Sales #Payment Cards #Privilege Escalation