SAP security note 1971397, “Missing authorization check in BW-BEX-OT”. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of BW-BEX-OT to which access should be restricted. This may result in an escalation of privileges.
Solution
To address this issue, import the appropriate Support Package for your SAP NetWeaver BW version:
- SAP NetWeaver BW 7.00: import Support Package 33 (SAP Note 1930762) for SAP NetWeaver BW 7.00 (SAPKW70033).
- SAP NetWeaver BW 7.01 (EHP 1): import Support Package 16 (SAP Note 1936601) for SAP NetWeaver BW 7.01 (SAPKW70116).
- SAP NetWeaver BW 7.02 (EHP 2): import Support Package 16 (SAP Note 1940530) for SAP NetWeaver BW 7.02 (SAPKW70216).
- SAP NetWeaver BW 7.11: import Support Package 14 (SAP Note 1940531) for SAP NetWeaver BW 7.11 (SAPKW71114).
- SAP NetWeaver BW 7.30: import Support Package 12 (SAP Note 1950117) for SAP NetWeaver BW 7.30 (SAPKW73012).
- SAP NetWeaver BW 7.31 (EHP 1): import Support Package 12 (SAP Note 1951409) for SAP NetWeaver BW 7.31 (SAPKW73112).
- SAP NetWeaver BW 7.40: import Support Package 7 (SAP Note 1955499) for SAP NetWeaver BW 7.40 (SAPKW74007).
The Support Packages will be available once the respective SAP Notes are released for customers.
Temporary correction instructions can be used before the mentioned Support Packages are available. Ensure you check Note 1668882 for transaction SNOTE before applying these instructions.
Reason and prerequisites
BW-BEX-OT does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
References
Full note on SAP: SAP Support Launchpad note 1971397
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
