Medium priority
SAP security note 2401265, “Missing Authorization check in the FM OBJECT_MAINTENANCE_CALL”, is a program error note released on 14.02.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The function module OBJECT_MAINTENANCE_CALL does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
Introduction of authority checks for S_PROJECT has been implemented in the FM OBJECT_MAINTENANCE_CALL.
Please implement the Support Package mentioned in this SAP Note, or apply the correction instruction.
Reason and prerequisites
Authorization check for S_PROJECT was missing in the FM OBJECT_MAINTENANCE_CALL.
Affected components
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 731
- SAP_BASIS 740
- SAP_BASIS 750 to 751
Full note on SAP: SAP Support Launchpad note 2401265
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].