SAP Security Note
HotNews
SAP security note 1557197, “Missing authorization check in portal connection”, is a program error note released on 12.04.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of the portal connection of the agency business to which access should be restricted. This may result in an escalation of privileges.
We strongly advise you to implement this note to solve the security problem.
Solution
Import the Support Package or implement the correction instructions. The correction does not affect the normal functions of the application.
Reason and prerequisites
The portal connection of the agency business does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
CVSS
Score 0
References
This note refers to
Referenced by
Full note on SAP: SAP Support Launchpad note 1557197
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].