High priority
SAP security note 1884512, "Missing authorization check in IS-A-ESD", released on September 10, 2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can call transactions to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the attached instructions provided in this note.
Reason and prerequisites
IS-A-ESD does not contain authorization checks for certain transactions, potentially leading to undesired system behavior.
Prerequisite: Note 1860258
CVSS
Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P
Affected components
- Industry-Specific Components > Automotive > Enhancements SD (IS-A-ESD)
- ECC-DIMP versions 602 to 606
Full note on SAP: SAP Support Launchpad note 1884512
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
