Missing authorization check in LE-TRM, SAP security note 2180125

SAP Note 2180125
SAP Security Note
Low priority

SAP security note 2180125, "Missing authorization check in LE-TRM", is a note released on January 13, 2016. Below are the symptom, SAP recommended solution and the affected software components.

ComponentLogistics Execution > Task & Resource Management (LE-TRM)

PriorityCorrection with low priority

TypeSAP Security Note

StatusReleased for Customer

Released onJanuary 13, 2016

LanguageEnglish

Description

Symptom

An authenticated user can use functions of LE-TRM to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instruction provided in the SAP Note.

Reason and prerequisites

LE-TRM does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may lead to undesired system behavior.

This document may cause side effects referenced in SAP Note 2263508 – External transaction calls are always rejected from LP00.

Affected components

EA-APPL: 110, 200, 500, 600, 602, 603, 604, 605, 606, 616, 617

Full note on SAP: SAP Support Launchpad note 2180125

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#EA-APPL #Authorization Check #Privilege Escalation #LE-TRM