SAP Security Note
Medium priority
SAP security note 1706769, "Missing authorization check in FS-RI", is a program error note released on 31.12.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can utilize functions within FS-RI that should be restricted, potentially leading to an escalation of privileges.
Solution
Implement authorization checks by following the steps outlined in the manual pre-implementation and post-implementation sections of the SAP Note.
- Perform the manual pre-implementation and post-implementation steps.
- After implementing this SAP Note, set the indicators for existing objects when confirming the changes.
Reason and prerequisites
FS-RI lacks proper authorization checks for certain functions, which may result in undesired system behavior.
Affected components
- Release 472
- Release 600
- Release 650
- Release 660
- Release 670
Full note on SAP: SAP Support Launchpad note 1706769
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
