SAP security note 1691744, "Missing authorization check in patient register", is a program error note released on 11.06.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can access functions of the patient register to which access should be restricted. This may result in an escalation of privileges.
Solution
- Program Corrections: The necessary program corrections are included in the corrections for this note. You can download them from here.
- Authorization Assignment: Assign users who should use this function the authorization object N_EINR_TCO for the desired transactions.
Reason and prerequisites
The patient register does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This may result in undesired system behavior.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1691744
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].