SAP security note 1462366, "Potential unauthorized reading of text tables". Below are the symptom and SAP recommended solution.
Description
Symptom
Program FINB_TR_DISPLAY_TEXT lacks any authorization check. As a result, anyone can read text tables for all applications maintained in the table for Finbasis TR Applications.
Solution
Implement the attached correction instructions or import the relevant support package.
Implement the attached code corrections. No further steps are needed. The code correction adds an authorization check for the program FINB_TR_DISPLAY_TEXT (object FB_SRV_TR, activity 03).
Reason and prerequisites
This is a security issue of low importance from the application’s perspective.
Full note on SAP: SAP Support Launchpad note 1462366
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
