Missing Authorization Check in Change logs component., SAP security note 1536091

SAP security note 1536091, "Missing Authorization Check in Change Logs Component", is a program error note released on March 8, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functionality of the Change Logs Component to which access should be restricted. This can potentially result in an Escalation of Privileges.

Solution

The note provides the required correction. To apply this security note, implement the correction provided.

Reason and prerequisites

The Change Logs Component lacks permission checks for an authenticated user's authorization to access some of its functionality. This may result in undesired system behavior.

CVSS

Score 5.5 Vector: AV:N/AC:L/AU:S/C:P/I:P/A:N

References

• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)