Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in HR Distributed-Reporting, SAP security note 1558284

SAP Note 1558284
HotNews

SAP security note 1558284, “Missing authorization check in HR Distributed-Reporting”, released on April 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentPayroll > Payroll: General Parts (PY-XX)
PriorityHotNews
StatusReleased for Customer
Released onApril 12, 2011

Description

Symptom

An authenticated user can exploit functions in HR Distributed-Reporting without proper authorization checks, potentially escalating privileges.

Solution

Implement the Business Add-In (BAdI) HRPAD00AUTH_DIST as per SAP Note 1531288. Alternatively, apply the corresponding Support Package SAPK-60433INSAPHRRXX.

CVSS

Score 8.2 Vector: AV:N/AC:M/AU:S/C:C/I:C/A:P

References

This note refers to

Affected components

  • Payroll > Payroll: General Parts (PY-XX)

Full note on SAP: SAP Support Launchpad note 1558284

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Payroll #Authorization check #Privilege escalation #HR Distributed-Reporting

Explore More