SAP security note 2874738, “Missing Authorization Check in S4 ACR Brazil Option”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Reports for Brazil do not perform required authorization checks, allowing abuse of functionality restricted to specific user groups and unauthorized access to restricted data.
Solution
Apply this SAP Security Note, or the corresponding Support Package for your S4CORE release, to add the missing authorization checks.
After implementing this note, the following reports include proper authorization checks:
- EFD ICMS IPI Report (/TMF/EFD_REPORT)
- ECF Report (/TMF/ECF_REPORT)
- ECD Report (/TMF/ECD_REPORT)
- EFD-Contribuições Report (/TMF/PCO)
CVSS
Score 3.8 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Affected components
- S4CORE 103
- S4CORE 104
Full note on SAP: SAP Support Launchpad note 2874738
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].