SAP security note 2457014, "Missing Authorization check in PA-PA-US", is a program error note released on 05.10.2017. Below are the symptom and SAP recommended solution.
Description
Symptom
PA-PA-US does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Missing authorization checks can lead to unauthorized access and manipulation of sensitive data within the Personnel Administration module, potentially compromising system security and data integrity.
Solution
Additional authorization checks have been included in the affected functions. To implement these changes in your system:
- Apply the correction instructions from this SAP Note.
- Alternatively, install the Support Package(s) indicated for your release in the Reference to Support Packages section of this Note.
References
Referenced by
- SAP Note 2542310 – Payroll Reconciliation Splitter background jobs issue (Concurrent Employment interaction)
Full note on SAP: SAP Support Launchpad note 2457014
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
