Missing Authorization check in XX-CSC-BR-REP, SAP security note 2469849

SAP security note 2469849, "Missing Authorization check in XX-CSC-BR-REP", is a note released on 14.11.2017. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

XX-CSC-BR-REP does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

As a general rule, SAP recommends that you install a solution by applying a Support Package. However, if you need to install a solution earlier, use the Note Assistant to implement the correction instruction. You can find more information about the Note Assistant in SAP Service Marketplace, under support.sap.com/kb-incidents/notes/assistant.

Note that documentation, transactions, and Customizing activities are only delivered via Support Package.

To implement the solution, you must implement the correction instructions that are valid for your release.

Reason and prerequisites

This SAP Note is relevant only for Brazil.

CVSS

Score 0

Affected components

• SAP_APPL 500
• SAP_APPL 600
• SAP_APPL 602
• SAP_APPL 603
• SAP_APPL 604
• SAP_APPL 605
• SAP_APPL 606
• SAP_APPL 616
• SAP_APPL 617
• SAP_APPL 618