Missing authorization check in Transaction Management, SAP security note 2512244

SAP security note 2512244, "Missing authorization check in Transaction Management", is a note. Below are the symptom, reason and prerequisites, SAP recommended solution and the affected software components.

Description

Symptom

Transaction Management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Potential impacts include:

• Abuse of functionality restricted to a particular user group.
• Read, modify, or delete restricted data.

Solution

Apply a preliminary correction via Correction Instructions or implement the corresponding Support Package.

Reason and prerequisites

Transaction Management lacks proper authorization checks for verifying an authenticated user's permissions to access certain functions, which may lead to undesired system behavior.

Affected components

• SAPSCORE: 110
• S4CORE: 101, 102
• EA-FINSERV: 600, 603, 604, 605, 606, 616, 617, 618, 800