High priority
SAP security note 1789823, "Missing authorization check in BC-BMT-WFM," is a program error note released on 12.03.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of BC-BMT-WFM to which access should be restricted. This may result in an escalation of privileges.
Solution
Coding gets completed by authorization checks. Navigation into workbench editors is implemented using an API. As a result, all functions of the workbench are now available.
CVSS
Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N
References
- Optimization of the workbench tool calls
- Automatic checks for security notes using RSECNOTE (outdated)
Affected components
- SAP_BASIS 640 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 731 to 731
- SAP_BASIS 740 to 740
Full note on SAP: SAP Support Launchpad note 1789823
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
