SAP Note 2138219
SAP security note 2138219, "Missing authorization check in BC-BMT-WFM". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of BC-BMT-WFM to which access should be restricted. This may result in an escalation of privileges.
Solution
Please apply this SAP Note 2138219 or the appropriate support package.
Reason and prerequisites
BC-BMT-WFM does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
References
This note refers to
Referenced by
Affected components
- SAP_BASIS (700 to 740)
Full note on SAP: SAP Support Launchpad note 2138219
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].