Missing authorization check in FS-RI, SAP security note 1706769

SAP Note 1706769
SAP Security Note
Medium priority

SAP security note 1706769, "Missing authorization check in FS-RI", is a program error note released on 31.12.2013. Below are the symptom, SAP recommended solution and the affected software components.

ComponentFinancial Services > Re-Insurance (FS-RI)

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version6

StatusReleased for Customer

Released on31.12.2013

Description

Symptom

An authenticated user can utilize functions within FS-RI that should be restricted, potentially leading to an escalation of privileges.

Solution

Implement authorization checks by following the steps outlined in the manual pre-implementation and post-implementation sections of the SAP Note.

Perform the manual pre-implementation and post-implementation steps.
After implementing this SAP Note, set the indicators for existing objects when confirming the changes.

Reason and prerequisites

FS-RI lacks proper authorization checks for certain functions, which may result in undesired system behavior.

Affected components

Release 472
Release 600
Release 650
Release 660
Release 670

Full note on SAP: SAP Support Launchpad note 1706769

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#FS-RI #Re-Insurance #Authorization check #Escalation of privileges