SAP security note 1750920, "Missing authorization check in FS-AM-CM-CF", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of FS-AM-CM-CF to which access should be restricted. This may result in an escalation of privileges.
The user can change or create a contract though he or she only has authorization for display of contracts.
Solution
Import the relevant Support Package for your release. You can use transaction SNOTE to implement the attached correction instructions in advance.
Reason and prerequisites
FS-AM-CM-CF does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
References
Full note on SAP: SAP Support Launchpad note 1750920
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
