SAP security note 1424714, "Missing Authorization Check in TA /SAPAPO/AMON2". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can exploit the functionality TR /SAPAPO/AMON2 to access restricted features, potentially leading to an escalation of privileges. This vulnerability arises because the authorization checks for accessing certain functionalities within TR /SAPAPO/AMON2 are insufficient.
Exploitation of this vulnerability can result in unauthorized access to sensitive system functionalities, compromising the security and integrity of the SAP system.
Solution
To address this issue, you should implement the provided correction instructions or upgrade to the corresponding support package. Detailed steps and packages are listed below.
References
- 1500012 – Switch from alert context menu is not possible
- 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Affected components
- SAP_APO: 30A to 30A, 310 to 310
- SCM: 400 to 400
- SCM_BASIS: 410 to 410, 500 to 500, 510 to 510, 700 to 700
Full note on SAP: SAP Support Launchpad note 1424714
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].