SAP Security Note
High priority
SAP security note 1612700, "Missing authorization check in ICM", released on March 13, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can access functions of ICM that should be restricted, potentially leading to an escalation of privileges.
Solution
The insufficient authorization check allows users to access the obsolete transaction CACS_GETSOURCE. This transaction is no longer needed and should be deleted to prevent unauthorized access.
- Go to transaction SE93.
- Enter the transaction code CACS_GETSOURCE.
- Click on the Delete icon.
- Click on the Save button.
Reason and prerequisites
ICM lacks authorization checks to verify a user’s permissions for accessing certain functions, which may result in unintended system behavior.
Affected components
- EA-APPL: 110, 200, 500, 600, 602, 603, 604, 605, 606
Full note on SAP: SAP Support Launchpad note 1612700
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
