Missing authorization check in CRM-MW-ADP functions, SAP security note 1906568

SAP security note 1906568, "Missing authorization check in CRM-MW-ADP functions", is a program error note released on 12.11.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of CRM-MW-ADP to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the provided support package or follow the correction instructions. No whitelist is required.

Reason and prerequisites

CRM-MW-ADP does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This may result in undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• External check for Remote Function Call (SAP Note 1882417)

Affected components

• PI_BASIS (version 701 to 740+)