Missing authorization check in IS-M, SAP security note 1853040

SAP security note 1853040, "Missing authorization check in IS-M". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of IS-Media to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the correction instruction attached to this note or install the most recent support package.

Reason and prerequisites

IS-Media does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P

References

Affected components

• IS-M: 604 to 604
• IS-M: 605 to 605
• IS-M: 606 to 606
• IS-M: 616 to 616
• IS-M: 617 to 617