Incorrect authorization check in IAC post processing, SAP security note 1909442

SAP security note 1909442, "Incorrect Authorization Check in IAC Post Processing", is a program error note released on 12.11.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of IS-M (IS-Media) to which access should be restricted. This may result in an escalation of privileges.

Solution

This correction will be available with the next Support Package. Alternatively, you can use the Note Assistant to implement an advance correction.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:N/I:P/A:N

References

• 1534608 – Missing authorization check in IAC postprocessing
• 1567038 – Update #1 to Security Note 1534608
• 1577886 – Update #2 to Security Note 1534608

Affected components

• IS-M (IS-Media): 464, 471, 472, 600, 602, 603, 604, 605, 606, 616, 617