Missing authorization check in FI-AP-AP-B1, SAP security note 2215605

SAP Note 2215605
SAP Security Note
High priority

SAP security note 2215605, "Missing authorization check in FI-AP-AP-B1", is a program error note released on 13.10.2015. Below are the symptom, SAP recommended solution and the affected software components.

ComponentFinancial Accounting > Accounts Payable > Basic Functions > Payment transfer (w/o DE, US)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version5

StatusReleased for Customer

Released on13.10.2015

LanguageEnglish

Description

Symptom

An authenticated user can use functions of FI-AP-AP-B1 to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instructions from the respective note as mentioned below or upgrade to the relevant support package.

SAP_APPL 617-700: 1983443
SAP_APPL 600-616: 2215605

Reason and prerequisites

FI-AP-AP-B1 does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 4.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

References

SAP Note 1983443 – Missing authorization check in FI-AP-AP-B1

Full note on SAP: SAP Support Launchpad note 2215605

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Accounts Payable #Payment Transfer #Authorization Check #FI-AP-AP-B1