Missing authorization check in CO-OM, SAP security note 1667805

SAP security note 1667805, “Missing authorization check in CO-OM”, is a program error note released on 14.02.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use transactions to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the corrections as specified in the SAP note.

Reason and prerequisites

The component CO-OM does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 7.5 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:C