Security note Missing authorization check for Web services, SAP security note 1120760

Description

For Web services (service interfaces), the authorization check against the authorization object S_SERVICE is not executed for the provider in the security log (part of the SOAP runtime).

Available fix and Supported packages

SAP_BASIS | 710 | 710
SAP_BASIS 710 | SAPKB71005 |

Affected component

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1120760

TAGS

#SOAP
#Simple-Object-Access-Protocol
#security-log
#WSSEC
#S_SERVICE
#RBAM
#AUTHORITY-CHECK
#Web-service

Explore More

SAP Security Patch Day – April 2025

April 8, 2025

On April 8, 2025, SAP released its monthly Security Patch Day updates, addressing 19 new vulnerabilities across various SAP products and components.

CVE-2025-0063 SQL Injection Vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

January 14, 2025

CVSS Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Affected Component: SAP NetWeaver AS for ABAP and ABAP Platform (Informix Database Interface) Description: A critical SQL injection

SAP Security Patch Day – January 2025 Overview

January 14, 2025

On January 14, 2025, SAP released its monthly Security Patch Day updates, addressing several vulnerabilities across various products, including SAP NetWeaver Application

How to Install the RedRays ABAP Security Plugin for Eclipse

December 23, 2024

The RedRays ABAP Security Plugin allows developers to analyze ABAP code for potential security vulnerabilities directly within Eclipse. Follow these step-by-step instructions

Vahagn Vardanian