Missing authorization check in HR Distributed-Reporting – CE, SAP security note 1779317

SAP security note 1779317, "Missing authorization check in HR Distributed-Reporting – CE". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of HR Distributed-Reporting to which access should be restricted. This may result in an escalation of privileges.

Solution

This note implements a call to Business Add-In HRPAD00AUTH_DIST with a default implementation restricting the executable reports to reports using HR logical databases. This Business Add-In is delivered with Note 1531288. Please follow the instructions provided there.

Then, implement the corresponding Support Package. Alternatively, implement the corresponding correction instructions. The relationship between the technical name and the HR Support Package can be found in SAP Note 1232082.

Reason and prerequisites

HR Distributed-Reporting does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 7.5 Vector: AV:N/AC:L/AU:N/C:P/I:P/A:P