SAP Security Note
High priority
SAP security note 1537089, "Missing authorization check in PP-BD-RTG", is a program error note released on 12.06.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of PP-BD-RTG to which access should be restricted. This may result in an escalation of privileges.
Solution
The corrections provided by this note.
Reason and prerequisites
PP-BD-RTG does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
CVSS
Score 6.1 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:C
References
This note refers to
Affected components
- SAP_APPL 46A-46B
- SAP_APPL 46C
- SAP_APPL 470
- SAP_APPL 500
- SAP_APPL 600
- SAP_APPL 602
- SAP_APPL 603
- SAP_APPL 604
- SAP_APPL 605
- SAP_APPL 606
Full note on SAP: SAP Support Launchpad note 1537089
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].