Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Unauthorized execution of functions in agency collections, SAP security note 1589707

Description

A malicious user can execute Italian FS-CD agency collection functions without the required authentication and authorization.

Important: This note is only relevant for customers who use FS-CD (software component INSURANCE) and (!) the Italian agency collections (BSP application ITAGCY, activation using transaction ITAGCYCUST -> “Basic Settings -> Basic settings for agency collections”) verwenden. Other customers are not affected and do not have to implement this note.

Available fix and Supported packages

  • INSURANCE | 472 | 472
  • INSURANCE | 600 | 600
  • INSURANCE | 602 | 602
  • INSURANCE | 603 | 603
  • INSURANCE | 604 | 604
  • INSURANCE | 605 | 605
  • INSURANCE | 606 | 606
  • INSURANCE | 616 | 616
  • INSURANCE 472 | SAPKIPIN22 |
  • INSURANCE 600 | SAPK-60021ININSURANC |
  • INSURANCE 602 | SAPK-60211ININSURANC |
  • INSURANCE 603 | SAPK-60310ININSURANC |
  • INSURANCE 604 | SAPK-60411ININSURANC |
  • INSURANCE 605 | SAPK-60507ININSURANC |
  • INSURANCE 606 | SAPK-60602ININSURANC |
  • INSURANCE 616 | 616 |

Affected component

    FS-CD
    Collections and Disbursements

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1589707

TAGS

#Cross-site-request-forgery
#XSRF
#business-server-pages
#BSP
#ITAGCY
#agency

More to explorer