Missing authorization check in EP-KM-COL component, SAP security note 1681997

SAP security note 1681997, “Missing authorization check in EP-KM-COL component”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use the functions of the EP-KM-COL component. The access to this component should be restricted. This case results in an escalation of privileges.

Solution

For SAP NetWeaver Portal 7.3 and 7.3 including enhancement package 1, a CTC template could be executed instead of the procedure described below. In case of CTC template execution for SAP NetWeaver 7.3 and 7.3 including enhancement package 1, refer to SAP note 599425.

Use the following procedure to change the permissions of the "attachment" repository after deploying the patches for KMCBC, KMCCM, and GROUPWARE:

• Configure the "attachment" repository to be listed in the root directory.
  • Log on to the portal as an administrator user.
  • Navigate to System Administration → System Configuration → Knowledge Management → Content Management → Repository Managers → CM Repository.
  • Select the "attachment" repository.
  • Choose "Edit".
  • Choose "Show Advanced Options".
  • Deselect the "Hide in Root Folder" property.
  • Save your entries.
• Configure the permissions of the "attachment" repository. When the patches are applied, the initial attachment repository permissions are set to "Everyone" (Full Control). To restrict the permissions of the repository, use the following procedure:
  • Navigate to Content Administration → KM Content.
  • From the context menu of the "attachment" repository, choose Details → Settings → Permissions.
  • In the "Permissions" tab, delete the permissions for the "Everyone" group and then add the following permissions: Name "content_admin_role", Permissions "Full Control".
  • Save your entries.

Main disclaimer for the new implementation: When the "Everyone" group is deleted from the permissions of the "attachment" repository, the users who have sent or received emails before the patch installation should no longer be able to access the attachments for their emails stored in this repository.

For more information about the affected releases, see the "SP Patch Level" tab page of this SAP note. For more information about the SP Stack schedule and updates, see Support Package Stacks maintenance schedule. Possible workaround before the release of the mentioned deliveries: there is no workaround possible.

This document is causing side effects: SAP Note 1752250 – PermissionExistsException when using attachments.

Reason and prerequisites

The EP-KM-COL component does not contain the authorization checks for the authorization of authenticated users to access some of its functions. This may result in undesired system behavior.

References

Affected components

• KMC-BC: 7.00 – 7.02+, 7.30+, 7.31+
• KMC-CM: 7.00 – 7.02+, 7.30+, 7.31+
• KMC-COLL: 7.00 – 7.02
• EP-CM: 6.0_640+
• GROUPWARE: 7.30+, 7.31+