SAP security note 1812543, "Missing authorization check in Web Dynpro ABAP". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This security note has been updated. For more detailed information, see Security Note 2000095.
An authenticated user can use functions of Web Dynpro ABAP to which access should be restricted. This may result in an escalation of privileges.
Solution
Please use the correction instruction of this note or the suitable service pack.
Reason and prerequisites
Web Dynpro ABAP does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.
Affected components
- SAP_UI: 740
- SAP_BASIS: 700, 701, 702, 710, 711, 720, 730, 731, 740
Full note on SAP: SAP Support Launchpad note 1812543
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].