Missing authorization checks in Runtime Workbench, SAP security note 1567389

SAP security note 1567389, “Missing authorization checks in Runtime Workbench”, is a note. Below are the symptom, SAP recommended solution, CVSS score and references.

Description

Symptom

An authenticated user can use functionality of some Runtime Workbench applications to which access should be restricted. This can potentially result in an escalation of privileges.

Solution

The following Support Packages include fixes with additional authentication checks for the described security issue:

• XI 3.0 SP28
• XI 7.00 SP25
• XI 7.01 SP10
• XI 7.02 SP08
• PI 7.10 SP13
• PI 7.11 SP08
• PI 7.30 SP03

For older Support Packages, the correction is available as a patch. Update the software components of the Adapter Engine to the patch levels maintained in the “SP Patch Level” section of this note or use newer versions. The archives and the support package stack guide can be found on the SAP Service Marketplace as described in SAP Note 952402.

Reason and prerequisites

Some JSP pages lack permission checks for an authenticated user’s authorization to access certain functionalities. This omission may result in undesired system behavior.

CVSS

Score 6.4 Vector: AV:N/AC:L/AU:N/C:P/I:P/A:N

References

• SAP EHP1 FOR SAP NETWEAVER PI 7.1 SP08
• SAP Netweaver for PI 7.10 Support Package 13
• SAP EhP1 for XI on Netweaver 7.00 SP10
• NW04s XI Support Package Stack 25
• SAP EhP2 for Netweaver 7.00 SP08
• XI 30 Support Package Stack (SPS) 28