Missing authorization check in FS-CD, SAP security note 2091973

SAP security note 2091973, "Missing authorization check in FS-CD". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of FS-CD to which access should be restricted. This may result in an escalation of privileges.

Solution

• Import the relevant support package: Ensure that you have the latest support packages installed for the INSURANCE component.
• Implement Correction Instructions: Follow the correction instructions provided in Correction Instructions to add the necessary authorization checks manually.

If you intend to continue using the report for testing purposes:

• Copy the report to the customer namespace.
• Remove the comment signs.
• Insert appropriate authorization checks.

Reason and prerequisites

FS-CD does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may lead to undesired system behavior.