SAP security note 1708026, "Missing authorization check in claim bundle/benefits catalog", is a note released on June 12, 2012. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can access functions of the claim bundle or benefits, services, and fees catalog that should be restricted. This may lead to an escalation of privileges.
Solution
Apply SAP Security Note 1708026 to implement the necessary authorization checks. This correction is classified as high priority and has been released for customers.
Reason and prerequisites
The claim bundle or benefits, services, and fees catalog lacks proper authorization checks to verify an authenticated user’s permissions for accessing certain functions. This omission can result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1708026
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].