SAP Note 1592294
SAP security note 1592294, “Missing authorization check in SAP NetWeaver PI”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of SAP NetWeaver PI to which access should be restricted. This may result in an escalation of privileges.
Solution
Apply the attached correction or the current Support Package (SP).
Reason and prerequisites
SAP NetWeaver PI does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This oversight may lead to undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1592294
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].