SAP security note 1477335, "Missing authorization check in support program", is a note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A support program from the Treasury area may display data even though the user who is logged on does not have the required authorization. As a result, there may be a privilege escalation.
Solution
Implement the advance corrections in accordance with the attached correction instructions or import the relevant Support Package.
Reason and prerequisites
In an analysis program for SAP Support, authorization checks that control the access of the function are missing.
References
Affected components
- FIN-FSCM-TRM-TM: Financial Supply Chain Management > Treasury and Risk Management > Transaction Manager
Full note on SAP: SAP Support Launchpad note 1477335
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
