SAP security note 1629303, "Missing authorization check in LOD-ESO-AS", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of LOD-ESO-AS to which access should be restricted. This may result in an escalation of privileges.
Solution
Fixes have been developed and released in Version 5.0 J, Version 5.1 Patch 10, and all Version 7.0 SP and patch releases. Update to the appropriate Release/Patch version to mitigate this risk.
Reason and prerequisites
LOD-ESO-AS does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1629303
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].