Missing authorization check in IS-B-BCA-AM, SAP security note 2057196

SAP security note 2057196, “Missing Authorization Check in IS-B-BCA-AM”. Below are the symptom and SAP recommended solution.

Description

Symptom

Account Management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This oversight can lead to:

• Abuse of functionality restricted to specific user groups
• Unauthorized read, modification, or deletion of restricted data

Solution

The affected functions have been updated to enforce proper access restrictions. To resolve this issue:

• Implement Correction Instructions: Follow the correction instructions provided in the note.
• Import Relevant Support Packages: Ensure that you import the necessary support packages applicable to your SAP system version.

Reason and prerequisites

The Account Management module lacks authorization checks to verify an authenticated user’s permissions for accessing certain functions. This missing check may cause undesired system behavior and potential security vulnerabilities.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• SAP Note 1903009