Missing authorization check in Transaction Management, SAP security note 2118946

SAP Note 2118946
SAP Security Note
Medium priority

SAP security note 2118946, "Missing authorization check in Transaction Management", is a program error note released on 10.03.2015. Below are the symptom and SAP recommended solution.

ComponentFinancial Supply Chain Management > Treasury and Risk Management > Transaction Manager > Transaction Management

CategoryProgram error

PriorityMedium priority

TypeSAP Security Note

Version4

StatusReleased for Customer

Released on10.03.2015

LanguageEnglish

Description

Symptom

An authenticated user can use functions of Transaction Management to which access should be restricted. This may result in an escalation of privileges.

Solution

The solution is available in the support packages listed below. If an advance correction is required, the correction instructions can be applied. It should be noted that the user is restricted to viewing only their data, and no authorization settings are changed.

Reason and prerequisites

Transaction Management does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 3.5 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

Full note on SAP: SAP Support Launchpad note 2118946

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #Authorization check #Treasury and Risk Management