Missing authorization check in XX-CSC-IN-FI, SAP security note 2201916

SAP Note 2201916
SAP Security Note
Medium priority

SAP security note 2201916, "Missing authorization check in XX-CSC-IN-FI", released on April 21, 2016. Below are the symptom and SAP recommended solution.

ComponentMiscellaneous > Country/Region-Specific Developments > India > use FI-LOC-FI-IN

PriorityCorrection with medium priority

TypeSAP Security Note

StatusReleased for Customer

Released onApril 21, 2016

Description

Symptom

An authenticated user can use functions of XX-CSC-IN-FI to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the provided code corrections to ensure proper authorization checks are in place.

Reason and prerequisites

XX-CSC-IN-FI does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This oversight can lead to undesired system behavior and potential security vulnerabilities.

Full note on SAP: SAP Support Launchpad note 2201916

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XX-CSC-IN-FI #FI-LOC-FI-IN #India