Description
Certain functions of Bank Analyzer Segmentation Service FS-BA-TO-SGS can be called even though the user that is logged on does not have the required authorization. This may result in an escalation of privileges.
Available fix and Supported packages
- FSAPPL | 200 | 200
- FSAPPL | 300 | 300
- BANK-ALYZE | 42 | 42
- BANK-ALYZE | 50 | 50
- FSAPPL 200 | SAPKISC313 |
- FSAPPL 300 | SAPK-30006INFSAPPL |
- BANK-ALYZE 42 | SAPKIBAM14 |
- BANK-ALYZE 50 | SAPKIBAL21 |
Affected component
- FS-BA-TO-SGS
Segmentation Service
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1514018
