High priority
SAP security note 1902986, "Missing whitelist check in CRM-FM-ACL", is a program error note released on 12.11.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of CRM-FM-ACL to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the provided support package or follow the correction instructions.
Reason and prerequisites
CRM-FM-ACL does not contain required checks against a positive set of allowed functions (i.e., whitelist) during execution of these functions. This is required to verify that authenticated users are allowed to access these functions. The missing check may result in undesired system behavior.
CVSS
Score 3.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:N
Affected components
- SAP_APPL 602
- SAP_APPL 603
- SAP_APPL 604
- SAP_APPL 605
- SAP_APPL 606
- SAP_APPL 616
- SAP_APPL 617
Full note on SAP: SAP Support Launchpad note 1902986
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].