SAP Security Note
High priority
SAP security note 1599953, "Missing authorization check in transaction launcher", is a program error note released on 13.12.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of the transaction launcher to which access should be restricted. This may result in an escalation of privileges.
Solution
Import the corrections provided in this SAP Note.
Reason and prerequisites
The transaction launcher does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may lead to undesired system behavior.
References
- 1458437 – Prepare old LTX remote part for local ITS of WEBCUIF701
- 1311813 – LTX – Hide data receive screen of LTX remote part
- 1470407 – Potential disclosure of persisted data in WEBCUIF
- 1620942 – Unauthorized use of appl. functions in Transaction Launcher
Affected components
- CRMUIF 520, 600
- WEBCUIF 700, 701, 730, 731, 746
Full note on SAP: SAP Support Launchpad note 1599953
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
