SAP security note 2152230, “Switchable authorization checks for RFC in Reconciliation Report Scheduler”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The standard `S_RFC` authorization checks may not be sufficient for certain RFC function modules, potentially allowing unauthorized access. This note addresses the need for more granular authorization controls in the Reconciliation Report Scheduler.
Solution
New switchable authorization checks are implemented and delivered in an inactive state to maintain compatibility. Administrators can activate these checks using transaction SACF. Detailed instructions are provided in the manual correction instructions attached to the note.
References
Affected components
- SAP_HRCUS: 600, 604, 608
- EA-HRCUS: 600, 602, 603, 604, 605, 606, 607, 608
Full note on SAP: SAP Support Launchpad note 2152230
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].