SAP security note 2449974, "Missing Authorization check in SAP ECC Sales Support", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP ECC Sales Support (SD-CAS-SA / SD-CAS-SP) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Impacts of missing authorization check:
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
Implement the Correction Instructions or Support Packages mentioned in this security note. An additional authorization check (object V_VBKA_VKO) has been added for three different Sales Support APIs.
CVSS
Score 8.8 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
This note refers to
- SAP Note 1353529 – BAPI: Error "is not an RTF file" (TD808)
Full note on SAP: SAP Support Launchpad note 2449974
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
