SAP security note 2479448, "Missing Authorization check in PY-US-TP", is a note released on 01.10.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
PY-US-TP does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue can lead to:
- Abuse of functionality restricted to specific user groups
- Unauthorized reading, modification, or deletion of restricted data
Solution
Apply the correction instructions provided in this SAP Note or implement the relevant Support Packages listed below.
Reason and prerequisites
PY-US-TP lacks sufficient authorization validations for certain functions, which may cause undesired system behavior.
References
- 607732 – MSC: Acknowledgment run TemSe file lacks entries.
- 323922 – INT: FI -> HR Acknowledgment revision
- 389081 – GEN: acknowledgment, company codes posting
- 447303 – INT: HR <-> FI Remittance acknowledgment update enhancement
- 613605 – MSC: Remittance status "acknowledgement failed" although ok
- 617508 – MSC: Missing acknowledgments (Head/branch office vendors)
- 766619 – MSC: Performance problems with acknowledgment runs
- 924042 – MSC: Acknowledgment run not updating all entries from TemSe
- 1541806 – 3PR: Check numbers missing in Garnishment History report.
- 1547042 – 3PR:FCH8 check cancellation not updating Remittance Status
- 1553320 – 3PR: Check cancellation not updating Remittance Status
- 1750053 – 3PR: Acknowledgment not undone for manual checks
- 980170 – ACK:Fails when there is a tax company override
- 2075403 – 3PR: Message ‘No entry in table T51R5 for CoCo &, PyT &, Pyee &, and posting run &’ is incorrectly displayed
- 2252643 – 3PR: Performance improvement in Automatic Payment Transaction
Affected components
- SAP_HR
- SAP_HRRXX
Full note on SAP: SAP Support Launchpad note 2479448
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].