Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing whitelist check in FI-LC, EC-CS, and EC-EIS, SAP security note 1860278

SAP Note 1860278
SAP Security Note
High priority

SAP security note 1860278, "Missing whitelist check in FI-LC, EC-CS, and EC-EIS", was released on September 7, 2013. Below are the symptom, SAP recommended solution and the affected software components.

PriorityCorrection with high priority
TypeSAP Security Note
StatusReleased for Customer
Released onSeptember 7, 2013

Description

Symptom

An authenticated user can exploit functions in FI-LC, EC-CS, or EC-EIS to escalate privileges due to missing whitelist checks. This vulnerability may result in unauthorized access and undesired system behavior.

Solution

Implement the provided support package or apply the correction instructions detailed in this note to address the missing whitelist checks.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

Affected components

  • Enterprise Controlling > Legal Consolidation (EC-CS)
  • Executive Information System (EC-EIS)
  • Financial Accounting > Legal Consolidation (FI-LC)

Full note on SAP: SAP Support Launchpad note 1860278

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Whitelist Check #FI-LC #EC-CS #EC-EIS

Explore More