Missing authorization check in FI-CA, SAP security note 1851835

SAP Note 1851835SAP Security NoteHigh priority

SAP security note 1851835, "Missing authorization check in FI-CA", is a program error note released on 09.07.2013. Below are the symptom, SAP recommended solution and the affected software components.

ComponentFI-CA (Financial Contract Accounting)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version5

StatusReleased for Customer

Released on09.07.2013

LanguageEnglish

Description

Symptom

An authenticated user can use functions of FI-CA to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the relevant correction instructions for your release or import the relevant Support Package.

Reason and prerequisites

FI-CA does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This may result in undesired system behavior.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P

Affected components

FI-CA versions 464, 471, 472, 600, 602, 603, 604, 605, 606, 616, 617

Full note on SAP: SAP Support Launchpad note 1851835

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#FI-CA #Financial Contract Accounting #Contract Accounting