SAP Security Note
Medium priority
SAP security note 2298657, "Missing Authorization check in SAP R/3 Enterprise Financial Services", is a program error note released on 10.05.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
IS-B-BCA-AM does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Some well-known impacts of Missing Authorization check are:
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
New authorization checks have been added for F_PAIT_BDA. Please implement the correction instructions or import the specified Support Package. There should be no impact on existing functionalities after implementing the security note.
CVSS
Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2298657
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].