SAP security note 1465993, "Directory Authorization Evaluation Non Functional". Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can access objects of Integration Directory to which access should be restricted. This can potentially result in an Escalation of Privileges.
Solution
The archives and the support package stack guide can be found on the SAP Service Marketplace.
Reason and prerequisites
Integration directory authorization lacks permission checks for an authenticated user’s authorization to access some/all of its objects. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1465993
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
