Skip links

Missing Authorization check in component CRM-BF-PC, SAP security note 2307916

Description

CRM-BF-PC does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

It is possible to insert a new card to a sales orders even though the authority object CRM_ORD_PC is not granted.

Available fix and Supported packages

  • BBPCRM | 700 | 700
  • BBPCRM | 701 | 701
  • BBPCRM | 702 | 702
  • BBPCRM | 712 | 712
  • BBPCRM | 713 | 713
  • BBPCRM | 714 | 714
  • BBPCRM 701 | SAPKU70115 |
  • BBPCRM 712 | SAPKU71210 |
  • BBPCRM 702 | SAPKU70217 |
  • BBPCRM 713 | SAPKU71312 |
  • BBPCRM 714 | SAPK-71403INBBPCRM |
  • BBPCRM 700 | SAPKU70019 |

Affected component

    CRM-BF-PC
    Payment Cards

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2307916

TAGS

#CRM_ORD_PC
#&160–Authorization-error
#Authorization-profile