SAP security note 2374165, “Missing Authorization check in BW Business Planning and Simulation”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
BW Business Planning and Simulation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Some well-known impacts of Missing Authorization check are:
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
Please implement the correction instruction of this note or the corresponding support package.
Reason and prerequisites
A user with authorizations for transaction se37 can execute a function module which could be used to escalate privileges. After the note implementation, this is no longer possible.
CVSS
Score 4.7 Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected components
- SAP_BW: Versions 700 to 702, 730, 731, 740, 750 to 751
- SAP_BW_VIRTUAL_COMP: Version 701
Full note on SAP: SAP Support Launchpad note 2374165
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].