High priority
SAP security note 1863150, "Missing authorization check in BC-ABA-SC", was released on July 9, 2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use transactions in the system to which access should be restricted. This may result in an escalation of privileges.
Solution
Import the relevant Support Package or implement the attached correction instructions.
Reason and prerequisites
BC-ABA-SC does not contain authorization checks for verifying an authenticated user’s authorization to access certain transactions. This may result in undesired system access.
Affected components
- SAP_BASIS: Versions 46C, 620, 640, 700, 702, 710, 730, 731, 740
Full note on SAP: SAP Support Launchpad note 1863150
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].