SAP security note 2024272, “Missing authorization check in IS-B-BCA-AM”, is a note. Below is the security information published by SAP for this note.
Description
Symptom
An authenticated user can use functions of IS-B-BCA-AM to which access should be restricted. This may result in an escalation of privileges.
Reason and prerequisites
IS-B-BCA-AM does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
Solution
Apply the correction, or import the relevant support package.
Additional information
- Download for SNOTE: Download
- PDF Version: Print PDF
- Edit Note: Edit
- Share by Email: Use the available event option on the SAP notes page.
- Open in New Window: Use the available event option on the SAP notes page.
For further assistance, visit SAP Support.
*Credits to Redrays for supporting the provision of this information.*
Full note on SAP: SAP Support Launchpad note 2024272
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].